Overview

overview

8

Static

static

3

2026-08-08...ar.exe

windows10-2004-x64

8

2026-08-08...ar.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    150s
  • max time network
    156s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    08/08/2026, 17:15

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-08_cc2748dcd27a32b759d9fc52abf54f41_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
  • Size 23.3MB
  • Sample260808-vsj8es1eld
  • SHA256 8a4c347a3aeb95249ae96145cc1a7720f2fb917ec86572bdfcd484401dd6f308
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
discoverypersistence

Malware Config

Signatures

  • Drops file in Drivers directory 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-08_cc2748dcd27a32b759d9fc52abf54f41_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-08_cc2748dcd27a32b759d9fc52abf54f41_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:1932
  • C:\Users\Admin\AppData\Local\Temp\2026-08-08_cc2748dcd27a32b759d9fc52abf54f41_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
    C:\Users\Admin\AppData\Local\Temp/2026-08-08_cc2748dcd27a32b759d9fc52abf54f41_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:3156

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        AppVShNotify.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
        • Size 23.6MB
        • SHA256 8f1629e9f18e5cf237edf315d938feb374b8e5ba468dabab9edc8bb96af0424a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        InspectorOfficeGadget.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
        • Size 46.7MB
        • SHA256 d7f8d22933251626833bb8183124a7ab9056e4b4d387423a0be28255aaa807c0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        IntegratedOffice.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
        • Size 27.4MB
        • SHA256 fc45b81f54ba8bc492dc80375a4f4beea315966358613a39cd5523aedd915510
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MavInject32.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
        • Size 47.0MB
        • SHA256 8e7c0f1ba50bb2cff95d5b1d55d2d62000296fa71e10e89223899b43517db813
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        OfficeC2RClient.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
        • Size 49.4MB
        • SHA256 5533ea952d5c6ce7047a5781a0b85f83c3040beca364d993dac6acaa6930eb0b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appvcleaner.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
        • Size 25.5MB
        • SHA256 120879ac551ad04677ef4d9cafd0779daca3da99efc9ab0884786b9b910d4bcb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VSTOInstaller.exe
        • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
        • Size 45.8MB
        • SHA256 d37a5a0094907e625a0f6615a2748f0622c99290ac204474fe0b0984f73b8685
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrmstp.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        • Size 35.8MB
        • SHA256 3a3ce9c18dc3e56febbf7052a99753d72df2dca90d59f2cacb59447a05168848
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        setup.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
        • Size 40.1MB
        • SHA256 4b21eefb58be462e78b070360c2f94ab2043dc45dcc277e5176c14245e271b04
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_pwa_launcher.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 41.7MB
        • SHA256 2563e586a56b2cc55875523ec8fea50bf9fafd98bc68da704ddd6358651623eb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notification_helper.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 40.4MB
        • SHA256 5e2421cd9a4834d331300b37aea556f43c3e22109ebd25735433463ad9f25b67
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        os_update_handler.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 38.9MB
        • SHA256 21e6f42dfb7dd4b8ecb8db6a94e8b81bb5e1f98c0a2e29b70ea9bd7ebfc0669f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_proxy.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 38.8MB
        • SHA256 d056d8ddd968d9d7c3b0b70761797b54fbaf29bac016bfad4b8c99c482f1de03
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 35.7MB
        • SHA256 02cbb76be0748b8a59f3f1d805c0a31af4a0ae732dbdbcf9ff83a3afee5c9b0b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 35.9MB
        • SHA256 3fc33be2257100a27c4870c4e763462cc8343fafdf6c70baea44f44cdd531464
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 37.6MB
        • SHA256 54a1e17c17bb723c76d2a4901764fe9e00b98c752928412ca9f3020823b5d374
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jarsigner.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        • Size 192KB
        • SHA256 c61d5a2b5856b5a273a4b636240fa277afc38dae069b227c270bb7f4cb23e995
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 36.4MB
        • SHA256 2c7804056cd9f603eb25ac4028f3778f1c3f6606232d6296f09c8b4e3afe3c79
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
        • Size 35.4MB
        • SHA256 6794dbd600de166810180ee056d4aff71f19dc308c4762250d037c41dc4cef3a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javac.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
        • Size 34.6MB
        • SHA256 7d587ca09a6838d8d251496d5408ec16fd8111e6113400478e17664963d4d059
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javadoc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
        • Size 32.9MB
        • SHA256 3540734a9a0ea55383acfb621c69f8196e09b31f6aea0466d8e77c23c4855c53
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javafxpackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
        • Size 32.4MB
        • SHA256 ff7d29368760b9b8620e690ee461660ec236b773b3b0823bc3b6bde0ceb73cf5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javah.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
        • Size 32.1MB
        • SHA256 822831784ae032671c18b468d5e9ee1e35775b59b67222e3c50acf526879defe
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
        • Size 31.1MB
        • SHA256 9aa0cbb8f4da2412b18cf73bdf217ac4713b378219848a8595886c5672e5476c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javapackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
        • Size 256KB
        • SHA256 60295b05dd477e3f151981e4ada08090298a0ddb349ba63df0f728dfc8f9cd6b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaw.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
        • Size 26.9MB
        • SHA256 54d15457a6e02b5a102406fc9df3f261bc96980f4bb887422f5075cbed8587aa
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jcmd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
        • Size 29.4MB
        • SHA256 ab6bbea5890d1b5c16e7e5e9c9597a6c91b03bc00698fa1269cb35e7322bc94b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdb.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
        • Size 23.5MB
        • SHA256 04110eb7367af4fe5d81a0360c34628cb83e730d93e55c62dff76c654952325f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdeps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
        • Size 26.0MB
        • SHA256 912b61da3b5891eb62728d5b3ceca7bfdba95d44f5363b3d1deafac1a8ec3c8c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jinfo.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
        • Size 25.8MB
        • SHA256 6c6daff3cb21e1dfa72a6cc8ffe01b0c554eca1492d32467f8a79ffeedceda0f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jjs.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
        • Size 28.4MB
        • SHA256 c41d2035d857c98fa21a96a64e6c74c367fdba17e7fc571c4a04ef31dafc82c7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jmap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
        • Size 28.3MB
        • SHA256 8499003ae1caf2c8d7b2820e1ec46e5dd10491bed303b13aa2fc6c235ae50568
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
        • Size 27.9MB
        • SHA256 71109dd4724ab2912449c0f8fe05f62be19469509dbb176c11b2bad792e63564
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstack.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
        • Size 27.8MB
        • SHA256 0a7079ac11070cfa2ed8ce97a7414044b007658075af082b90c04b7a1813de05
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
        • Size 27.9MB
        • SHA256 fe6e032b6cd7774ef07332a54421474f28400c6384bf1541ab4fcc5540d57995
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstatd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
        • Size 25.0MB
        • SHA256 e6dac7681931f6be6d042f1996dc6cf24610a3142b7c91b3981680241057d190
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        keytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
        • Size 27.5MB
        • SHA256 b783a8c03562b306709b926335b6a3eedc07a60e3380fc23fbf12ab6072d5447
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        kinit.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
        • Size 24.9MB
        • SHA256 98b6906ead111407b5e9932fc3bc17b8a1dcf510c8fc44cd9b4cc9bf3b1b5403
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        klist.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
        • Size 24.7MB
        • SHA256 00cc528293dff3a09699253a5ac3058881e59727e0e9166c9bf935b756ff1a6c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ktab.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
        • Size 27.4MB
        • SHA256 d3119d52982eeb62d94a6f30a1796c1f019f22c5431ce09972d2c1edcb04553c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        native2ascii.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
        • Size 24.6MB
        • SHA256 94ea59d888cb352934028f73e5658bb10d1777ac25b1b6487ac8384a2b292eab
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        orbd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
        • Size 27.2MB
        • SHA256 ade281410e631f6dbcf2c5d541519e5c254c4524f24552615a161dfd2a41eea2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        policytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
        • Size 27.1MB
        • SHA256 f42dac2ce221e2b602780fe208a66a851d382f51d74b324686cccea42165a3d1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmic.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
        • Size 27.2MB
        • SHA256 f8ed14be406cb69b0b65aede71489709bc28d3e1b761116b23f54f78bafad651
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmid.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
        • Size 23.8MB
        • SHA256 5f1f2cad764b18e3b22f5daf5057a577d6aeb2e43cd3523b33679ecbf687bb8b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmiregistry.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
        • Size 26.4MB
        • SHA256 378d4173bac5710a9c8726105b5dfcc233f2986507b1d7540106dfb25b216870
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        schemagen.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
        • Size 26.3MB
        • SHA256 a6b431a39689c98f65d53888e18d34f8a238e0c619b0a745eec6799377d668c9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        serialver.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
        • Size 26.2MB
        • SHA256 ccf7ef67ac017978371820b9b74c3717b85c04acd02ecb879830604ddff36ab8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        tnameserv.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
        • Size 26.2MB
        • SHA256 c4040cfe932ce17279c7bd92a0124cd3ba3ab89cf6d5c0dd6706aafe0c337246
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dotnet.exe
        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 45.0MB
        • SHA256 069bc747c739c222a25880bcfc07246b70404caf51b128b70c104debec7e5121
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 44.1MB
        • SHA256 1e031e1bd571fad0eb4aff58d7911b1a38cd1b327bac24e0a7dda6799eb5ecbc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 43.8MB
        • SHA256 66cd27599b97eb66fe76805585660908c37b10e9698a57e2ae201033a2ab4c4c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download