Overview

overview

8

Static

static

3

2026-08-08...ar.exe

windows10-2004-x64

8

2026-08-08...ar.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    95s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260513-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    08/08/2026, 17:15

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-08_cc2748dcd27a32b759d9fc52abf54f41_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
  • Size 23.3MB
  • Sample260808-vsj8es1eld
  • SHA256 8a4c347a3aeb95249ae96145cc1a7720f2fb917ec86572bdfcd484401dd6f308
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
discoverypersistence

Malware Config

Signatures

  • Drops file in Drivers directory 3 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-08_cc2748dcd27a32b759d9fc52abf54f41_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-08_cc2748dcd27a32b759d9fc52abf54f41_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:3168
  • C:\Users\Admin\AppData\Local\Temp\2026-08-08_cc2748dcd27a32b759d9fc52abf54f41_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
    C:\Users\Admin\AppData\Local\Temp/2026-08-08_cc2748dcd27a32b759d9fc52abf54f41_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:4252

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        7zG.exe
        • Path C:\Program Files\7-Zip\7zG.exe
        • Size 24.0MB
        • SHA256 3cbe7e3e431f6c48df4a0bebc8eb07af4fc6539c2708f9bee6e79e51fd544d32
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrmstp.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        • Size 52.7MB
        • SHA256 2d0c20df80a6356cdef8e2e8857d5aed9dfe9a301674197f01290550eb1e8911
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_pwa_launcher.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 48.4MB
        • SHA256 72549d3f5f00e9855bd34e695017aeccc58b1d8921a64f1ad9902a2807d6617b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevated_tracing_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 50.1MB
        • SHA256 e8e1124ef50d75347e00ea471d24ceb602229094d9afa2700f5f3cbf3d56d6ca
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 48.9MB
        • SHA256 83d2762d2964b8842c35b7e3a24cc6417c8ff1bfbca1f77737fffe7954e5953b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notification_helper.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 48.3MB
        • SHA256 0af61496ff692e9cb439e8873e7154023cc8940d9b8b8000331f08b1d5f456f4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 49.7MB
        • SHA256 5566759c07106e12882c83f328471d33f7aa1921ea37f7b94661fbf6819e2522
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_proxy.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 48.1MB
        • SHA256 5a78f02bbba36c0633208e4ce4e76bbd82ae8ab15a5efc46d3c36eb1ef1af6fa
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 46.7MB
        • SHA256 73440ace24f6a162e82040b18902c7cfe2294321883062ae959cd90fc397c776
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 46.7MB
        • SHA256 44216f232882f8195a4f424465060fc6eccf4d184bae6aa27a0e6ca7744713e9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 46.7MB
        • SHA256 33748be07638eb3a7a1e96093ad717f238c383478e7c083106f38b8ec176f213
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jarsigner.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        • Size 46.7MB
        • SHA256 2633c62bb24784c623fbdef86b407941c9a8004a9acefad55a2cae57ee174aa9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
        • Size 46.9MB
        • SHA256 40fd386f986bfdb95b0c84d99a4f6c19f316003f172ffcdc596992a115f6a4ab
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javac.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
        • Size 46.7MB
        • SHA256 feff32ff846a3b1ad86b73d362bc9cb5e2958c6d9ee053cb4f315975385e0330
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javadoc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
        • Size 46.7MB
        • SHA256 b225e2cd28443dacc53bf2021cccee82b22220833921f3f0c68e5643c81f91b7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javafxpackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
        • Size 33.3MB
        • SHA256 f4d8ee262535bbbee1c7998340ffb1e6d77afa4574991b52f3fe6d5e5e8446ac
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javah.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
        • Size 34.4MB
        • SHA256 ddc289923c8ec36b2e96f94e8dc13e8f1f2781ee58a243c4a17073dea39ff302
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
        • Size 128KB
        • SHA256 43487443e34438846ba103b7924eff4a32e10c362356ffe679e3f7f007a74316
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javapackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
        • Size 33.8MB
        • SHA256 c4f04eac40bc2677474ae624d68dd52671ba0e68302ccab7241a546df04bcd78
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaw.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
        • Size 32.5MB
        • SHA256 c85d3bf90b8d4acd1abd7a2a099e39e2051c01ee9b7372ffd65628d350a9c9fd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
        • Size 32.4MB
        • SHA256 5f6eb7f28a9db23031d810ed9701ea4502d6ed5788732cdb86feb24bf4361745
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jcmd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
        • Size 30.6MB
        • SHA256 95d7de01f0935a3b204145ee0f7e8184b3a5c6c044339cded0e83ba165de5042
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jconsole.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
        • Size 30.8MB
        • SHA256 0418fb86eb3fe641c9ac68f0ef86be095ddcc9017e7660ca7e16bf990cc7870b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdb.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
        • Size 31.2MB
        • SHA256 041928a92fdbcc35bbe303ff7b356fd24fedd405a9ab7c9da62497011e21a08c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jhat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
        • Size 31.6MB
        • SHA256 3990be29ea896ac2f698938204ab328676a930379f46749cbf98bf5cde3d7851
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jinfo.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
        • Size 30.5MB
        • SHA256 58c8d5a115c44a6f5d0983eb9359c95bd0db1125a52bf5988cc97a8feeab0ecb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jmap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
        • Size 30.2MB
        • SHA256 ca9429182ec53e9d8b54d45533eee87f117d05fec0683e5bf04d2197419cdcab
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
        • Size 29.9MB
        • SHA256 8a8ad5e2b5bdf972a828ed4e01fe7e703a5d05cc2c8925008550fe7dd34bc524
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jsadebugd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
        • Size 29.0MB
        • SHA256 7ad60864591ef4177dd05bab0d64d903320bbd324447d195f1955dfc5619383c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstack.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
        • Size 30.0MB
        • SHA256 f89c2639258c9b327ad14e3cdff2140af8cea86fda33df20473896b82d47bac0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
        • Size 29.1MB
        • SHA256 dc53dbd88c5caedd636257a4be305d6f7e255ac7bf69636d508212c83a08834f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstatd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
        • Size 28.8MB
        • SHA256 d142d9daa0f2d33cd7c527ae13bcd601cef7d7873e94db0d10c90815784dc1fb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        keytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
        • Size 29.2MB
        • SHA256 a273116f8156a8d7c0e3e52990d3184c9de84673f4f6f7acbcf482b95eaa6881
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        klist.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
        • Size 28.6MB
        • SHA256 a72d226a6b97c7e53ae931b7afe148636827349bb6186e5a48c206b203dcac70
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        native2ascii.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
        • Size 28.1MB
        • SHA256 990cfcd072dca754597f686f63d7faa7ca133ff9cecbb44054d70fbd870b4e24
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
        • Size 28.5MB
        • SHA256 261fe07b14c3014663a33a2d3dd184244fc5cc4685f58650f4781fe627a1512e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmic.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
        • Size 28.9MB
        • SHA256 2ec6c3075d9404f2605c93b5fb60c7b0fe534822321116b2cdbc8dfd3f3908f3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmiregistry.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
        • Size 27.8MB
        • SHA256 e6608d0f42eba976ca4c60d03ded2a5652b74801165921983c6f070330a27e1f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        serialver.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
        • Size 28.2MB
        • SHA256 d07e0fcd3889d9a8af95b1769d72535fc3c2db4adb6f9ff1dd657e9abd25d217
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        unpack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\unpack200.exe
        • Size 26.1MB
        • SHA256 c0492a39d274b4f56659da140e1f124a31dac0ee0d364c1538ae686463705ba0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        wsimport.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
        • Size 28.0MB
        • SHA256 012805489e16b584942e696a097222fd9240a9eeb536a06f290907de26108269
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        xjc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
        • Size 25.9MB
        • SHA256 110e2ec15aba0a409cf599e27f75fa2e7a52057239bbd467f652499491f94400
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 23.4MB
        • SHA256 273f77b6d641c4a6d5f9c916a92d2d1e1053ac92ff1f97d2d2e095a7cb358857
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 46.7MB
        • SHA256 b84239f56b5754198408f9d4ff838accf2e2065126bf74cfbff223cfe1af85db
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 46.7MB
        • SHA256 7208a0ea95fd77d7da06d7f2f9a767942611c292d5bdb773264dbdbb7cdce8ed
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        spo0lve.exe
        • Path C:\windows\SysWOW64\drivers\spo0lve.exe
        • Size 23.3MB
        • SHA256 8a4c347a3aeb95249ae96145cc1a7720f2fb917ec86572bdfcd484401dd6f308
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download