Overview

overview

8

Static

static

3

2026-08-08...ar.exe

windows10-2004-x64

8

2026-08-08...ar.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    143s
  • max time network
    147s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260513-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    08/08/2026, 18:11

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-08_1bb16042fcb964d15cdd273e167af3af_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_stealc_vidar.exe
  • Size 20.7MB
  • Sample260808-wss11asdkf
  • SHA256 99a0e04ef9dba9d780fcf241b69a1f0321c9abef882ecf56094e8a421370baea
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
discoverypersistence

Malware Config

Signatures

  • Drops file in Drivers directory 3 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-08_1bb16042fcb964d15cdd273e167af3af_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_stealc_vidar.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-08_1bb16042fcb964d15cdd273e167af3af_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_stealc_vidar.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:2396
  • C:\Users\Admin\AppData\Local\Temp\2026-08-08_1bb16042fcb964d15cdd273e167af3af_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_stealc_vidar.exe
    C:\Users\Admin\AppData\Local\Temp/2026-08-08_1bb16042fcb964d15cdd273e167af3af_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_stealc_vidar.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:1128

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        7zG.exe
        • Path C:\Program Files\7-Zip\7zG.exe
        • Size 21.4MB
        • SHA256 29ec134fa8035c746a93a75ef5c70a8e77b9f023fccf3f278fdebe30d37c5049
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        AppVShNotify.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
        • Size 21.0MB
        • SHA256 786f87cd89675a036172f62a340f844368c9123de8303b67b6b62b15d4dd020e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        IntegratedOffice.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
        • Size 24.8MB
        • SHA256 347a3cc8feb20ec2fc000f7ea022d04ad51632ba89f65acaa812884d93f681aa
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MavInject32.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
        • Size 41.8MB
        • SHA256 99d9cd34abd78057178a09d98d6693fb61c5f7113369e6d90ff9c0c423f3c4e9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        OfficeC2RClient.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
        • Size 64.9MB
        • SHA256 aad50818ebab0aa5fda4436d2360f9a610049a649642d8eedea4e4a84afc541c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VSTOInstaller.exe
        • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
        • Size 41.6MB
        • SHA256 5e08b096a2f23038f7085c18a4d30bb3a589a4c125585eb74ec6bcc77c51a6f6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrmstp.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        • Size 47.5MB
        • SHA256 f40d18ed2ee343299a91c6a355137eb9aae60cfd1195be8793d01d6c65897c4f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_pwa_launcher.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 43.2MB
        • SHA256 a4b5e43a1a17e8ac6462ab762354bdcd625cffef832178f0f07fb8b851cb6f37
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevated_tracing_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 44.9MB
        • SHA256 b50903f954de9d9cac61e5c0ac828d3a1715fb475161d7d479501db60c4fb44e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 43.7MB
        • SHA256 851592ceca3a22e98c64a9a88c680f11afdb09201e68d15a5333dfe5d26e9134
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notification_helper.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 43.1MB
        • SHA256 c1dcc627fb7bddf32fe701b15a003d0ce0587e966cdad0e708a2e15d60fb86cf
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        os_update_handler.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 43.3MB
        • SHA256 b237a704a8509bcd545dc15c8860610c06d544f0adcc55235c9fef245d03c4b3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 44.5MB
        • SHA256 6cc192d507240c4c39afa2f77fedf857c600d86b4ee11516e2eaaea33cb2581e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_proxy.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 42.9MB
        • SHA256 00355cbe38251a72d84e01c278b0c0a43e6b4a7c9cbaad85845df292f77ca56d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 41.5MB
        • SHA256 426f0124f92ba526101622c93d074d7dbf62b901074b402f3b43e01b8e695f19
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 41.5MB
        • SHA256 e6623b04d024f6c5317b6537f3900f606f005a5e7269bc73706bb25a7441cd3e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 41.5MB
        • SHA256 434ff1c414191ef4fa34959718faec724fa91d3d1e209649d4393e424e00a7c5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 41.5MB
        • SHA256 698d99ed0e182ad6b8e6fdbd1207f6e3b662f5e6c6d8571bd2dc0d6f4e004364
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jar.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 41.5MB
        • SHA256 a605cb6e5cc7140f738691da9185c12392b474e72c2cefb3e6f3147925aa0224
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jarsigner.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        • Size 41.5MB
        • SHA256 65cbf83860a8c250d6e7ad63da5d0be87d3fea1661f3f310e37a2465e7a95f69
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 41.5MB
        • SHA256 ff2bf9f919277e760abbce87f1913702629a35c8e809278027451305cccfe661
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
        • Size 41.8MB
        • SHA256 d29fea2453d8cbcb9c00fcaf1a39982faa24410bb5da0bcb4ecff10885f35bae
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javac.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
        • Size 41.5MB
        • SHA256 366d890cb80eb79204d3ac8cf0a2fc3a7e85f80f1c5fb6287b8c5eec3aa1e0d5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javadoc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
        • Size 41.5MB
        • SHA256 26cddbe11112e76ca2fe2536619aaa3e92116337d52313baebc56519df5949be
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javafxpackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
        • Size 20.9MB
        • SHA256 a91edde86b62cb5b5808b7bc94c3d3066528006c62dfde279a2e330b95edfcc8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
        • Size 41.5MB
        • SHA256 581ab3bc0fa778b534fd6b507304bfaf1f52f63b575d4accdc86da6b129b3930
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javapackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
        • Size 41.6MB
        • SHA256 24a3a48531e3f40f5328f88491b0442e2dbe4a8fd54267d6fcc8af0c3c0083eb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaw.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
        • Size 41.8MB
        • SHA256 9baf7747f840595a5a2daf389ac5406eddf563bbc7a15930443cf4fa50ed3c6f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
        • Size 41.9MB
        • SHA256 81cb3cd0b728fb18d29c01d5e13dc1dff6cce2f0eb47c42e2420ade77a7028c0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jcmd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
        • Size 41.5MB
        • SHA256 ef5b343590521ba75804c5b3137d725e6991c9ec050a34c19d9b5611718efc8d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jconsole.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
        • Size 41.5MB
        • SHA256 2d0783e9316736ad2e3c38c21f99425d28aa9ef70742e94bf74d7c2628bed77f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdb.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
        • Size 41.5MB
        • SHA256 d49584be5515c8b1e41167517b816bad5926c29e7f1d0aed3b63ead87c1ebe70
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdeps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
        • Size 41.5MB
        • SHA256 5dd437204d234d4834945bc5c29cbf9ab70056ce463789c3df87e9877dabaa4b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jinfo.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
        • Size 41.5MB
        • SHA256 bce8571e86bd798b7e78c3c1f3b59623a3a6f9bb6216e8e9ca39965e7d6924a9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jjs.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
        • Size 41.5MB
        • SHA256 ea0506000e897f0316ed21b6020f2eb9cfdeaea30e1607f032862de6a9cbdc76
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jmap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
        • Size 41.5MB
        • SHA256 108388cda26c09f5693bb2f16fde44d66942137f063f13712a277ed3435898e8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
        • Size 41.5MB
        • SHA256 390e66fb097f263dbdcf4aa50818a163dbb2aac2893c32b2be4b79aed9e621be
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jsadebugd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
        • Size 41.5MB
        • SHA256 02e4c933e6e5b342e0e1bb0e244644a6ce0bf515b2febf2d769ea4a2ce546994
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstack.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
        • Size 20.8MB
        • SHA256 ec120e705c457ce5bd10eeb2a8c35c35b7668c0a2e9c2729c52855b44a5945da
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
        • Size 34.8MB
        • SHA256 1d82905e1139b76016fc68fe0591da735d3028ddc25792a2a9fb33d902599066
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstatd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
        • Size 31.2MB
        • SHA256 0ede6cebf2b49cdaea49ae03cbb109b2c9b6ef7964bed9f1c336181a2b7c742d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        keytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
        • Size 24.8MB
        • SHA256 137bb0de67774530f348fa624edc2ae8f543e3eb4319be835c2754c69a14d155
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        kinit.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
        • Size 30.8MB
        • SHA256 9e729ed345d7e1d28f80b33e2922668ca0000dcf88b3cf135706db1fdd30a3fb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        klist.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
        • Size 31.6MB
        • SHA256 e8051d6fe168a693c9f1cb7ee6a4ad872bce77b2cb4da2579802a24b0c3095b0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ktab.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
        • Size 30.3MB
        • SHA256 e89697fd773b84cc48d34a7bdff70b5659eade98bc56cdc66f2e8cadedd23bfd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        native2ascii.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
        • Size 12.8MB
        • SHA256 e7f07a22a71911d39f45ee17a77090c63e89e2741341d87662c39482fae7f093
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        orbd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
        • Size 11.8MB
        • SHA256 5eead371cf46c5bc31731b374449360513f63aac3bc773c995560b10d0e7891a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dotnet.exe
        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 41.6MB
        • SHA256 525832cd080cc85b13dda280d21614b0e43b7a7813b2ae20c8e2e4f7643e08bf
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 41.5MB
        • SHA256 5a28d828d0771fc9cd3f9f9e4e2a583838e06d1df5b45680cde5523a097dde67
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 41.5MB
        • SHA256 00efd6e2f72e14aed68312984969846f9c6dbe1f847be2ce9d8f176e1c90d7d9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 41.5MB
        • SHA256 3ea67f5d649180ae07150e525dff470cb1d11e40f5d115c61e52f87f8ed90086
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        spo0lve.exe
        • Path C:\windows\SysWOW64\drivers\spo0lve.exe
        • Size 20.7MB
        • SHA256 99a0e04ef9dba9d780fcf241b69a1f0321c9abef882ecf56094e8a421370baea
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download