Overview

overview

8

Static

static

3

2026-08-09...ar.exe

windows10-2004-x64

8

2026-08-09...ar.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    150s
  • max time network
    152s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260513-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    09/08/2026, 15:58

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-09_cbf741b335df9255e262090dc982f84d_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
  • Size 17.1MB
  • Sample260809-teha8sbc26
  • SHA256 9cf5efda3177d674d0b95f5003cff79d600765ad6450ef73713ca46c8c1e35a3
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
discoverypersistence

Malware Config

Signatures

  • Drops file in Drivers directory 3 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-09_cbf741b335df9255e262090dc982f84d_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-09_cbf741b335df9255e262090dc982f84d_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:2676
  • C:\Users\Admin\AppData\Local\Temp\2026-08-09_cbf741b335df9255e262090dc982f84d_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
    C:\Users\Admin\AppData\Local\Temp/2026-08-09_cbf741b335df9255e262090dc982f84d_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:944

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        7zG.exe
        • Path C:\Program Files\7-Zip\7zG.exe
        • Size 17.7MB
        • SHA256 f87b0eb08f70e49f402acf5023d35f7c06797a712e293f4571fed7e6e8e1df8f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javac.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
        • Size 17.1MB
        • SHA256 ea22ac347b6c464f925804b99474bf40ef61a65f5f5af0b2e494c87813d220c8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javadoc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
        • Size 17.1MB
        • SHA256 7dda02b0fa14380cd8dc6617ce34c8a9fa78fd582d35b39ec113247f731e0998
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javafxpackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
        • Size 34.3MB
        • SHA256 72dfb335c1794950b202923d26d9e4fc8fd279d019f08a03fe5732cff54bb16d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javah.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
        • Size 34.1MB
        • SHA256 8261fe57c917cd6c7f8f6da505e68942c0eddbe0d7fe991775f43cfddce5a43c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
        • Size 34.1MB
        • SHA256 d63ee12fbad30ea398fc3ffdb297e9e1af12c481dade60a35b76b1ecd3482669
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javapackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
        • Size 34.3MB
        • SHA256 ecc4f868a27f11644a38e0ab6ccb502a65acbc9b454e31472c1a68414785d938
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaw.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
        • Size 34.4MB
        • SHA256 77ec6b4322024f7564c91dceeafcb765fda7d3b004c695e62ea21b342e45ca3d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
        • Size 34.6MB
        • SHA256 1736840a29ced3c8c610ad4c6ce88b89a6417d7236625768e5537eaee1b3530a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jcmd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
        • Size 34.1MB
        • SHA256 5cf1a29e76b6b6e7026db025a48019b5dbf3b611fa10d91f9562905887365f9e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jconsole.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
        • Size 34.1MB
        • SHA256 74391ab7f3256b8e478b99a1dfcc1f15a3a2ff07a3d7ed9f0b87c2ed7cfd0d3d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jhat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
        • Size 34.1MB
        • SHA256 c9bbec6cecd203c8fc831a79ed62f3b4f5aed2502a96168e7afc70b2201f272f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jinfo.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
        • Size 34.1MB
        • SHA256 edc8384b25dc6cb5b3701d19fea95017a7ac6ca6ce7922eeb63470c1e38c17d7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jjs.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
        • Size 34.1MB
        • SHA256 b6e146fafb741a4fae365b276cd7d66488288471416ad9ace981af92131fcd32
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jmap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
        • Size 34.1MB
        • SHA256 e5d1d739b69bc5f0171e09bdee157160a4c648972e3a571040ca573040a6d094
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
        • Size 34.1MB
        • SHA256 c616d96593414574554aa2f824f2ad1e04713b4534f40d840f994ce30c19fbb1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jrunscript.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
        • Size 34.1MB
        • SHA256 124b5a65f9f0f0d7e80b80840fccdf958869c450a2bb2fe75f2cb3af24e62099
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jsadebugd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
        • Size 34.1MB
        • SHA256 68ce8420b65b770f9651d7885c39bba7b44123ccb266c5c2b2ec42798ff3316d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstack.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
        • Size 34.1MB
        • SHA256 e4bd8e5b4e3fb86a34c3e6d93f466eb6fd40015ea4cb5e90d3235e2b2b373e07
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
        • Size 34.1MB
        • SHA256 17f126ec362b7690b54ea4314216c8ae070f05c2b93b02bfabcb02e9e152bf9b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstatd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
        • Size 34.1MB
        • SHA256 71dc2092e71d30ea2822caa66a6880371ed8d54001c04243e849d9534a422f9a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        keytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
        • Size 34.1MB
        • SHA256 afe0be68691c96a917bf95a16bf3f515adef3d174cbf5dabd4af55b8db91d0e1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        kinit.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
        • Size 34.1MB
        • SHA256 ce31082497ab2e8bda556f2e728c9b695483e4a8b56792912835612abb835365
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        klist.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
        • Size 34.1MB
        • SHA256 f74814d8ef7a388dc5f0962a5dc1d73f5d66694ad6d6a314016d7aa4c97b6d7a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        native2ascii.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
        • Size 34.1MB
        • SHA256 e2b1c86bfb4fc084ad379942db7877892c9612432bcdffe39d3396c700251e10
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        orbd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
        • Size 34.1MB
        • SHA256 32c5dc4a80e08b9105fa4505ed171661cde7189c45c713730b3cd036e87cdb61
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
        • Size 34.1MB
        • SHA256 d4be6b08f8f473140b8a4095233e558a852d4eccfc2f151f46f1e7102e1441c4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        policytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
        • Size 34.1MB
        • SHA256 20ece4f48389c4a80331350683e2da617593328970effa66042c92f9612649f7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmic.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
        • Size 34.1MB
        • SHA256 d37d8a6eb40757bd003d538186fafe15dd4a1b15a03da7714b72930259b6e215
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmid.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
        • Size 34.1MB
        • SHA256 9f88b1aafbd7d652e6b095489daec5d7ae4e429795b6f6ba241bd0d6b8d74226
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmiregistry.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
        • Size 17.1MB
        • SHA256 2987eadcf37ca16fa0d29e571cb0dc6eafa565c2e62dd757dd7cfe586e593b43
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        serialver.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
        • Size 34.1MB
        • SHA256 0622a057210aaf28a4790af20d83bffe4ff4f843a619c5c66212311f52549393
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        servertool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
        • Size 34.1MB
        • SHA256 f76a0098533f020b37456655be257706c2434e7be272972dd15603c9f3f6bec6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        tnameserv.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
        • Size 34.1MB
        • SHA256 9b6bf40932cb459ce81bc50121f0251ca4288e0867b546fc81f87f6efd4a18bd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        unpack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\unpack200.exe
        • Size 34.3MB
        • SHA256 4549873fd19fdbce95340f69f38534ca664b6ff5293ff44ebd628f5d80759b48
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        wsgen.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
        • Size 34.1MB
        • SHA256 9cc24e13e8404ee5ba8d9dee6abfc6efe80204ebd766dc94f2827ee12ed3ead5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        wsimport.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
        • Size 34.1MB
        • SHA256 386d7a7776edf1a90a225596c3b847bdc9febf09b3385ed6377dde65de9bd5f7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        xjc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
        • Size 34.1MB
        • SHA256 b9238eb8449be9713f87fc54196cfa163f1120ec68ffb4e31a887b4d404f443f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe
        • Size 34.1MB
        • SHA256 bc33d70e679f1b250657d16103701cd65ed449415289d7d808236d924a781823
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javacpl.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe
        • Size 34.2MB
        • SHA256 e906e75de1c69d2aad62ce8bf9af3d64928dca7d539228b0a657da2ce4a602e8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaw.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe
        • Size 34.4MB
        • SHA256 d3e926c8cddb8f857769ff596f13c9a7c8b918a2ac8ddfd55ab90f72166d29aa
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe
        • Size 34.6MB
        • SHA256 bbffee8c4149703460725bf43b0c2fd489a3c7ad2d57651c45cf6e583e600ffc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jjs.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe
        • Size 34.1MB
        • SHA256 43300f4190e4be0d8a115bee207dedf017fa1045ff0e3969eddff9bce341629f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jp2launcher.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe
        • Size 34.3MB
        • SHA256 fb7bdf2f3785c8576a17005af84c866231371dfc58d99d54f09552ab80914fc6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        keytool.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe
        • Size 34.1MB
        • SHA256 5fd3f20b5b15341f7e34f208361495271f3624ffaf14f64266b2c00a6964f003
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        klist.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe
        • Size 34.1MB
        • SHA256 bf7b0ff97c2d0561d29bbaeeadcb1413257eef4c962a4e4e52509bd256d230f0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ktab.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe
        • Size 34.1MB
        • SHA256 52ad9eb16225a3b0ca2e99b1e2e22cd5f82b001ebf552e4d8c7b358e77a12b9a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        orbd.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe
        • Size 34.1MB
        • SHA256 452f7c295a2bab575618c6e687a7943a2530294e85c0a142454114ebb5d4ec90
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pack200.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe
        • Size 34.1MB
        • SHA256 5a9bc9da5e01dbce1dba1c3c4cbd24d677f40a62f6b02c33f2ab9c14e13770b4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        policytool.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe
        • Size 34.1MB
        • SHA256 e608941ffff162cc0768e6fc9113a0b40d477b82afc5ddc0c86b32b04c8cf05e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmid.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe
        • Size 34.1MB
        • SHA256 29d6147acc36a1eb11c5a1efcca21e9c390dda967b397d3d1707eb02d33164f1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmiregistry.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe
        • Size 34.1MB
        • SHA256 6a90966706c60255e639f7c84ec2e80b11a15596c731e5b4011a28da8aeb121f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        servertool.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe
        • Size 34.1MB
        • SHA256 495b824bd69175db0982728ccc57821aff45de447fd82fd739f4c596821bc773
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ssvagent.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe
        • Size 34.2MB
        • SHA256 5c796ec6311a8bdaa44906a7ff3e60a58a3d47f2fe0fbe3016877af5c7ed6b2a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        tnameserv.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe
        • Size 34.1MB
        • SHA256 e1999c8d72ddc71a0f6d2de93b8eca2bd05248ae8dbff14004f6a7792442bbc3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        unpack200.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe
        • Size 34.3MB
        • SHA256 e47babf08d3785b553564ea2685ab7204fea271da6d614da22c4126225c8c408
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        fontconfig.properties.src
        • Path C:\Program Files\Java\jdk-1.8\jre\lib\fontconfig.properties.src
        • Size 28.2MB
        • SHA256 f235c4dfe272e39950ed4b3a0793e79164c424336a9ed26beaf81e415a87fca5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        spo0lve.exe
        • Path C:\windows\SysWOW64\drivers\spo0lve.exe
        • Size 17.1MB
        • SHA256 9cf5efda3177d674d0b95f5003cff79d600765ad6450ef73713ca46c8c1e35a3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/944-2-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download

        memory/944-6-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download

        memory/2676-0-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download

        memory/2676-5-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download