Overview

overview

8

Static

static

3

2026-08-10...ar.exe

windows10-2004-x64

8

2026-08-10...ar.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    150s
  • max time network
    155s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    10/08/2026, 17:22

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-10_645210bc08385ae804e5feaf2aa90cf1_cobalt-strike_elex_emotet_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe
  • Size 17.8MB
  • Sample260810-vxxpbatfnf
  • SHA256 d7ab4d06c5f60cc5e7b92ce2b8ef3d2cd38b4fb6f86bed72daf209da7d736438
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
discoverypersistence

Malware Config

Signatures

  • Drops file in Drivers directory 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-10_645210bc08385ae804e5feaf2aa90cf1_cobalt-strike_elex_emotet_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-10_645210bc08385ae804e5feaf2aa90cf1_cobalt-strike_elex_emotet_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:2336
  • C:\Users\Admin\AppData\Local\Temp\2026-08-10_645210bc08385ae804e5feaf2aa90cf1_cobalt-strike_elex_emotet_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe
    C:\Users\Admin\AppData\Local\Temp/2026-08-10_645210bc08385ae804e5feaf2aa90cf1_cobalt-strike_elex_emotet_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:3424

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        AppVShNotify.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
        • Size 35.9MB
        • SHA256 461aff8fff8c7ff7d72e550e40dfa9b8938eeb530a846e457db9746a24b319e2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        InspectorOfficeGadget.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
        • Size 17.8MB
        • SHA256 83157e8a2b91db00a4812d9e796948a3fa1ffef8bc60a71585aa97f76808d530
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        IntegratedOffice.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
        • Size 39.7MB
        • SHA256 363ac2ec49a0c958cdbbeb420261b2cd0e91bdf3328772ef073a64fcff2a3871
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MavInject32.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
        • Size 35.9MB
        • SHA256 26950b538436da2494547cc712463802f225e4f9d9b3795bb826cbb8ef0b65c9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        OfficeC2RClient.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
        • Size 59.1MB
        • SHA256 345a390e2f49a936f7dc158fa01f7fd529d1da817d2deaa3472ee77c635f738e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appvcleaner.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
        • Size 19.9MB
        • SHA256 c3ce554b7f1904a95210f4cf9f95e22cb1fd1f045a9860304db5910795c03e27
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VSTOInstaller.exe
        • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
        • Size 35.7MB
        • SHA256 3c60d7f64e8d9ae7e25d73dee4f8fabccba021b4bc90dfcbbaf36532e184b7a9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrmstp.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        • Size 41.7MB
        • SHA256 318ceb6919e18e3eb9b77667a0edaa9dea04280836fe64a26c8441209d76ab0a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_pwa_launcher.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 37.3MB
        • SHA256 ca8ba2fccddfccff97c9b94efca0f698487d757f20988d91c85866f4f210b07b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevated_tracing_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 39.1MB
        • SHA256 539578c661fd2f9587740619df7d32a81c99e4f162e615c0c3816791b1fa817b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 37.9MB
        • SHA256 8832bf3a7177276c42122538fe1bccac78b0f6f037ab3a76e04ba317e23ec5e8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notification_helper.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 37.2MB
        • SHA256 d76e8383b08554da76e1a5bec9ed23dd4cac1e75155bdc7d10ac57ef9283a348
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        os_update_handler.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 37.4MB
        • SHA256 e107950f18e4379f52dc8faa9e4f1bce68ef358792b8ef99957ddbdbe4aa1e5d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 38.7MB
        • SHA256 5f1cf66f75ad2e7a88fe2970f66dfbdff19d5b1268f0ba6373b2cc2a1780add6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_proxy.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 37.0MB
        • SHA256 151ef25c521372b7fef1878238e2f394fbf5f6ebbd0837a84487a74008760da0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javafxpackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
        • Size 35.8MB
        • SHA256 3be134beab94684d41af0edba0d0b17d924413ace1a8b48239627a6275947ba9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
        • Size 35.6MB
        • SHA256 579cb040121281e19eaa0a458a9acb1b16cb1c7c8852d0d3bdb7e035e703c5db
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javapackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
        • Size 35.8MB
        • SHA256 f5d2c6816fadd7a9dff679e34c93c3c71cd2751b127b1c910b69351fc8bd6a5c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jcmd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
        • Size 35.6MB
        • SHA256 55d1d063a0d71000ecf1cf7ae8cc7e94d1726d1c2048967186606fccff749a14
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jconsole.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
        • Size 35.6MB
        • SHA256 29f77dede6db0c844b38a661ded949ca3c4379f72507756f6416606fba4802b1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jhat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
        • Size 35.6MB
        • SHA256 f97829a5ec6bfe0949821ad55b651fbfe384d3118dd4b03fdd76f48816e48a10
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jinfo.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
        • Size 35.6MB
        • SHA256 df015b1a583961e52c6a0c98ce60f665f7783be7832694875795a785d4ca3903
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jjs.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
        • Size 35.6MB
        • SHA256 ff40d4a089f4dccde7361bd510a90ce4634e6660f53d5c4cb5fe9d0e83708470
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jmap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
        • Size 35.6MB
        • SHA256 239768e760c32c6764deef0cef2ca8ce0bf05bc28dab44970cb2315101481474
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jsadebugd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
        • Size 35.6MB
        • SHA256 bdedf3bab7fdf602387a3420d8ef17e22463f37fae279ca4ae117d6af051f8b7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstack.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
        • Size 35.6MB
        • SHA256 aa5ad9be245f82ececcd7a414c32a5b6233493bd8f4d5a960747cb1207730bef
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
        • Size 35.6MB
        • SHA256 57eb6141e04eff5be47c7800e8d118e1f3e9d3b8699fa15a262b5073afe966d6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstatd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
        • Size 35.6MB
        • SHA256 bccbb327269c85d5d5673a5c11d51a9a81022876d9361df65c7791bc103c34a0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        keytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
        • Size 35.6MB
        • SHA256 19090504d794b6dd5f0411ba4a53930361efd668d541bf8b1f433fadfd652029
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        klist.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
        • Size 35.6MB
        • SHA256 0cd142b736b655aaf92bd95d8899966d4fd39fe3964f98f03cf35a4a1064d19f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ktab.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
        • Size 35.6MB
        • SHA256 81e129f59309432326f5e494359c32079a610e98069407c443e740ee1c11170f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        native2ascii.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
        • Size 35.6MB
        • SHA256 9238a1d289dd83e6144c910f1753d38dda3bd41f2be78122f647b3dc8c654c88
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        orbd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
        • Size 35.6MB
        • SHA256 078af871cb3953cb84fdb6bdf14e4cdedf42df33fb2ae2207b0d0f999639972f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
        • Size 35.6MB
        • SHA256 9129e17098d1e4dac2f3da5aeec5dbaa8f5b82ef664b3a14041a0cbdb1dcfb1e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        policytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
        • Size 35.6MB
        • SHA256 1d3259a297f3d1cc18a19b93137a073c858c5af2a3a9b14836637f24d05d7992
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmic.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
        • Size 35.6MB
        • SHA256 919c9c9d88b1dca020992ab778a9385165c380fb07c9ab07423f5f01d64be076
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmid.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
        • Size 35.6MB
        • SHA256 29e9977b42b6f1edeb959054a98c2b48bffaf46d7e320dfb972f9f23ac99d311
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmiregistry.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
        • Size 35.6MB
        • SHA256 16ec937f623b4ada8fd314da579bd9d3af90d1c061697de37c078d2eae5e14b1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        schemagen.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
        • Size 35.6MB
        • SHA256 9d8e511e69c6eaecec6ca2ec8b7f71940f1ae141971942d3f308a595f3a552d6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        serialver.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
        • Size 35.6MB
        • SHA256 28725b4ad176266252d3a7bdb7e34595b6775154823682f546c883ff17e9446c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        servertool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
        • Size 35.6MB
        • SHA256 4a36bfc2953873386159510b89703062607579086a1c1fa8454b89cd00faa5da
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        tnameserv.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
        • Size 35.6MB
        • SHA256 660367f210094615e7d6b59bb9b7386a4274dd56fc6c0e79efd48f71ac5c8849
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dotnet.exe
        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 35.7MB
        • SHA256 863eae7e525c3fd1e479dc65b1c50574ddd3e14145b2ce5ce96b50a464f363cc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 35.7MB
        • SHA256 21419327bbb1a9636e1f479b54b81d5d7e06fd676f6bc325f7524148957984b0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 35.7MB
        • SHA256 2f67cb19153d52f0ee43d20b509b4561e93da87edb5658fc1bd4506c4e78f44c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 35.7MB
        • SHA256 11203efc6458e35dfbdb69120e25e63d1bae1cae391f4aef5c889cfe139f4ee9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download