Overview

overview

8

Static

static

3

2026-08-08...ar.exe

windows10-2004-x64

8

2026-08-08...ar.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    23s
  • max time network
    149s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    08/08/2026, 18:11

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-08_1bb16042fcb964d15cdd273e167af3af_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_stealc_vidar.exe
  • Size 20.7MB
  • Sample260808-wss11asdkf
  • SHA256 99a0e04ef9dba9d780fcf241b69a1f0321c9abef882ecf56094e8a421370baea
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
discoverypersistence

Malware Config

Signatures

  • Drops file in Drivers directory 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-08_1bb16042fcb964d15cdd273e167af3af_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_stealc_vidar.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-08_1bb16042fcb964d15cdd273e167af3af_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_stealc_vidar.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:468
  • C:\Users\Admin\AppData\Local\Temp\2026-08-08_1bb16042fcb964d15cdd273e167af3af_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_stealc_vidar.exe
    C:\Users\Admin\AppData\Local\Temp/2026-08-08_1bb16042fcb964d15cdd273e167af3af_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_stealc_vidar.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:404

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        AppVShNotify.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
        • Size 21.0MB
        • SHA256 786f87cd89675a036172f62a340f844368c9123de8303b67b6b62b15d4dd020e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        InspectorOfficeGadget.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
        • Size 41.5MB
        • SHA256 5f47cdee7eacd25b46c7b8a38eb63b7c6cb281200e30216ed2066af21323a64f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        IntegratedOffice.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
        • Size 45.6MB
        • SHA256 518ecaa79bb1511e5cd59ac98ece13c0419f977c5ab6e51dc6978c9d2fe6b5ec
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MavInject32.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
        • Size 41.8MB
        • SHA256 99d9cd34abd78057178a09d98d6693fb61c5f7113369e6d90ff9c0c423f3c4e9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        OfficeC2RClient.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
        • Size 49.6MB
        • SHA256 428debef764390d5d7346ac31c5b1887fbbc25bc316c115975d07d250244d840
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appvcleaner.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
        • Size 22.9MB
        • SHA256 ab798ba48d46f6804227150b23abe68378207aad20a9f14eb8b850e73030fd87
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VSTOInstaller.exe
        • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
        • Size 41.6MB
        • SHA256 5e08b096a2f23038f7085c18a4d30bb3a589a4c125585eb74ec6bcc77c51a6f6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrmstp.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        • Size 45.8MB
        • SHA256 5e35ad333261ea17da3d589f91b29edd31b685a7eb42a9ab94fcc53e8b837cb0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        setup.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
        • Size 44.4MB
        • SHA256 2f9f9e84ec0922afaee896af4eaf36eed407184fb20a3aed465ab2f3d2a70815
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 43.7MB
        • SHA256 851592ceca3a22e98c64a9a88c680f11afdb09201e68d15a5333dfe5d26e9134
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notification_helper.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 41.2MB
        • SHA256 af8ce3457ea227f07c74223078a72a47fffb4f9aa9dcec67df76a140c70bc3cd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        os_update_handler.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 43.3MB
        • SHA256 b237a704a8509bcd545dc15c8860610c06d544f0adcc55235c9fef245d03c4b3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 43.9MB
        • SHA256 157ea0c6c90dd541140301aec9d022cb9363a4542e2d299910626d1cca84a36e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_proxy.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 42.9MB
        • SHA256 00355cbe38251a72d84e01c278b0c0a43e6b4a7c9cbaad85845df292f77ca56d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 41.5MB
        • SHA256 426f0124f92ba526101622c93d074d7dbf62b901074b402f3b43e01b8e695f19
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 38.0MB
        • SHA256 534bab0ea51a724e2ffa4110581c635099f9ec964423f766e70d944179a644ab
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 38.3MB
        • SHA256 c67f560ce511cbf574522553cb2dc4554c5abdb20123e4b415a8a1ac57e34aa3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 41.5MB
        • SHA256 698d99ed0e182ad6b8e6fdbd1207f6e3b662f5e6c6d8571bd2dc0d6f4e004364
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jar.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 37.0MB
        • SHA256 50f66455ac14f0e247fb2937f1b3e4e4c214c0bc0ecd262f07c0696f7ea67683
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jarsigner.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        • Size 40.2MB
        • SHA256 d6dd975524e258850777c9fc139d984cc14de792c9313b183ebbf8359b115f7d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 39.6MB
        • SHA256 f3a50c817183ef105c8dbd8a95cca144e9bca6ed9e4161114d58661fa4a8ac2c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
        • Size 31.6MB
        • SHA256 5def183ddd535f55217775c6f952857161405534ef570f4f70fd837ea9a6bd32
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javac.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
        • Size 36.4MB
        • SHA256 cb310eaeecc79bb3e94208b2b5a7a93f2a86f94dc583b4da43ab90717cea2f6a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javadoc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
        • Size 35.8MB
        • SHA256 822e6bd26a781887cca8cf211edb4d9a9f57f745025fda412775f4c7ce2af466
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javafxpackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
        • Size 35.9MB
        • SHA256 6e14066538db41531017e97df37c4e2c71bf1c7dc6461dcfeae70ac278f7d5d1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javah.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
        • Size 34.8MB
        • SHA256 9d451673f8cf403d7858b7e081c3754c28b66fbb118a5c5c0f1c70dade6efb0f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
        • Size 39.2MB
        • SHA256 4323964e81f5f255a29891ad741faa3cd91e72044def09b0904b0e6b63ebf32a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javapackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
        • Size 39.8MB
        • SHA256 4cce3606e5d7091acd10afcb0f6eff928791fa203a1a58be52464550c2c3d1f1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaw.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
        • Size 36.4MB
        • SHA256 08b482248f17196de9fa439a18ea0c208aed67ba86abb5ff8deb2f64adf801d6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
        • Size 38.6MB
        • SHA256 08b9e637b1470121e07cab6837d33b34eded82f56d31fe5e7c4401ee3801d5c1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jcmd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
        • Size 38.9MB
        • SHA256 77a3507652dcf4f7e9d4537548e89706f272bb5ac7e180eafa3f30dab0eb962b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jconsole.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
        • Size 38.2MB
        • SHA256 70f527b5080fb6cfa0b7d8aef5eb1889879043dccc49b72f02c6cb6e7baaee84
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdb.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
        • Size 30.9MB
        • SHA256 961b479fdc6e09a6130922c5ce0b9b04d2d84ddea711449a35cce9f1f147bec4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdeps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
        • Size 36.3MB
        • SHA256 6b2c196d2a3507c6d96938cbf574d59c75aa445a1d21d3f6b04fa177c5f7363a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jinfo.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
        • Size 38.1MB
        • SHA256 18845e7fd2803dc5ed0f347c208f7cbecb6b70b94d20edfe2a7deaf8b59f4477
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jrunscript.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
        • Size 34.6MB
        • SHA256 dc63d66652af5591c47f4ed97a42454c4d516a1f91414dfd2aa91c06c540a397
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jsadebugd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
        • Size 37.9MB
        • SHA256 d065a8b7cca1d76c7385a200f4244e6cedc2c02e09a01ffd9c00fa389fc44929
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
        • Size 34.0MB
        • SHA256 0acd6b109536b0bd55eee1420ac26bffbd991eac3121bae6b2f35dc8cab08d1e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        keytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
        • Size 34.1MB
        • SHA256 133703739fafbefcef6226cbaaabbecb4626dcada48533cd3ae3a91300645a55
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        klist.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
        • Size 37.8MB
        • SHA256 30361ea4697f2647c0cc7c04cfac87c7d9fe0317e4ee1baaf597311589f2dcad
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ktab.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
        • Size 38.8MB
        • SHA256 9a6c078daa92a7ed3e8d94273ee6d2597ab578e7832c31122d5020e623d2af11
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        native2ascii.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
        • Size 34.2MB
        • SHA256 a3a4e1951154f93c7c669f42676e156620004b4010ac88dbf2a6e1caeb3fbcc1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        orbd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
        • Size 38.2MB
        • SHA256 d08314c975b6da3f54f627044b671ec9f5059a7c0f41154bd3ac99e97cd87d08
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
        • Size 38.5MB
        • SHA256 f701798f1b2d8119ca4e7983406593d6805d8f50471dd47667d4c55c9c37d9bb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        policytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
        • Size 36.6MB
        • SHA256 300564ce2b6f2bc67e16cb03f709727b6b8b7b165f968296d63a8e998ed6c526
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmic.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
        • Size 33.1MB
        • SHA256 718031a9071b600d2c62a5d0c7b2321966fc93b339e9ad30b293d88c8753edee
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmid.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
        • Size 36.9MB
        • SHA256 b503672dfe403318acf6242274951b4f90afe5c6b5afd7e8533e14f065dc6875
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmiregistry.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
        • Size 36.1MB
        • SHA256 7e31d6c1c1cea6397ab3e3bb54400856559b2b07c8a5173b4291ef853c531769
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        schemagen.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
        • Size 35.9MB
        • SHA256 d56befde1f737ace82001b291a7b2347e43601565b8e099d6a9373cefdb3584e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        serialver.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
        • Size 36.2MB
        • SHA256 e1cf42d327ac296c090131974e48c97b2bbcd46a8b22ccd49b0c5115cb36f5d1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        servertool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
        • Size 36.1MB
        • SHA256 1aa9d894cf87b371da86c06a3b3b8808b5a87e7cc8dd1a07c823074d2279d0fa
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        tnameserv.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
        • Size 28.6MB
        • SHA256 ce9c29881cc358aa7ffee89fc8fdf63e9bcb533257d2e8c76e21d675ca17996b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dotnet.exe
        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 41.6MB
        • SHA256 525832cd080cc85b13dda280d21614b0e43b7a7813b2ae20c8e2e4f7643e08bf
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download