Analysis

  • max time kernel
    148s
  • max time network
    153s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    11/08/2026, 20:54

General

  • Target
    2026-08-11_5533d6ce80d0c05598e7a66b6c15789e_cobalt-strike_elex_emotet_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe
  • Size 11.8MB
  • Sample260811-zpyc4adj21
  • SHA256 7ff642e695db38b72809d265161549fc638f462d36f6869c6ca0ff17b5a31e9f
  • MD5 SHA1 SHA512 SSDEEP TLSH

Malware Config

Signatures

  • Drops file in Drivers directory 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • Sets desktop wallpaper using registry 2 TTPs 2 IoCs
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies Control Panel 4 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-11_5533d6ce80d0c05598e7a66b6c15789e_cobalt-strike_elex_emotet_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-11_5533d6ce80d0c05598e7a66b6c15789e_cobalt-strike_elex_emotet_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:3756
  • C:\Users\Admin\AppData\Local\Temp\2026-08-11_5533d6ce80d0c05598e7a66b6c15789e_cobalt-strike_elex_emotet_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe
    C:\Users\Admin\AppData\Local\Temp/2026-08-11_5533d6ce80d0c05598e7a66b6c15789e_cobalt-strike_elex_emotet_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:5364

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        7z.exe

        • Path C:\Program Files\7-Zip\7z.exe
        • Size 12.3MB
        • SHA256 9737c633fe95ad16211b1d33b8c50ecec2dc4185b9b97605d580a5fdb29a68c8
        • MD5 SHA1 SHA512 SSDEEP TLSH

        7zFM.exe

        • Path C:\Program Files\7-Zip\7zFM.exe
        • Size 12.7MB
        • SHA256 2dedea695f068a91dc6ea4e6b6676f24db15f80660951ca51f64c2a9219ad534
        • MD5 SHA1 SHA512 SSDEEP TLSH

        7zG.exe

        • Path C:\Program Files\7-Zip\7zG.exe
        • Size 24.2MB
        • SHA256 9fb34b6c7d2f5712e140bb1c122f5f6763b90581cbd8c03b7e3b6458a6c0f33d
        • MD5 SHA1 SHA512 SSDEEP TLSH

        Uninstall.exe

        • Path C:\Program Files\7-Zip\Uninstall.exe
        • Size 11.8MB
        • SHA256 b6893c83ae23b6f7776c70361bc71d4c4c990e9779bf372b5ca80cf2dfcec6a2
        • MD5 SHA1 SHA512 SSDEEP TLSH

        AppVShNotify.exe

        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
        • Size 23.8MB
        • SHA256 2ac752b2e17ce1b953854ea6b5ffc950c3526d3bff0819dea25fb9c61421b0b5
        • MD5 SHA1 SHA512 SSDEEP TLSH

        InspectorOfficeGadget.exe

        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
        • Size 23.5MB
        • SHA256 2ffe58fa5a70cf3c2787011d8de44cda8f1c4ef9451f64e99fde9884eeb1b513
        • MD5 SHA1 SHA512 SSDEEP TLSH

        IntegratedOffice.exe

        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
        • Size 27.6MB
        • SHA256 8923c3b01cca0dd9e719b9292d99b25513ac3ee52e32afbbaf12a12d5a4b2d5d
        • MD5 SHA1 SHA512 SSDEEP TLSH

        MavInject32.exe

        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
        • Size 23.9MB
        • SHA256 620f4363f12d9a9af05be90d0e435465bb036d9e16f1aa347748693b3aaa71d3
        • MD5 SHA1 SHA512 SSDEEP TLSH

        OfficeC2RClient.exe

        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
        • Size 47.0MB
        • SHA256 ec1071f6004c09910db8ac2cc7578bc306f1b9249b485fe696354d62b706c3f7
        • MD5 SHA1 SHA512 SSDEEP TLSH

        appvcleaner.exe

        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
        • Size 25.6MB
        • SHA256 59f0194f5962b08d28988f80e569630baea09e119ebfebcc1f9add0f1902ad17
        • MD5 SHA1 SHA512 SSDEEP TLSH

        VSTOInstaller.exe

        • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
        • Size 23.6MB
        • SHA256 2bd19e910ad1cbd4a27da86ca1dda2b9b39d7da00247d5a2e9d840a3698853e6
        • MD5 SHA1 SHA512 SSDEEP TLSH

        chrmstp.exe

        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        • Size 29.6MB
        • SHA256 00e753217e0fdccf06ffaad7c6515f29e2d7adfb2ed08c4df0404339e309fcad
        • MD5 SHA1 SHA512 SSDEEP TLSH

        chrome_pwa_launcher.exe

        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 25.2MB
        • SHA256 bd712f36e14e4e0243316077c7877ed26e64a75bba1a6d60d67e8d912ac1519d
        • MD5 SHA1 SHA512 SSDEEP TLSH

        elevated_tracing_service.exe

        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 27.0MB
        • SHA256 82abb011f3496e2069433d995ef2d193e26f8d486d5f0ca04d40d9cc07625fda
        • MD5 SHA1 SHA512 SSDEEP TLSH

        elevation_service.exe

        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 25.8MB
        • SHA256 f4ea0c837b16a583b846511929bf59b4f745245ee336725f6e9201ff6151bffb
        • MD5 SHA1 SHA512 SSDEEP TLSH

        notification_helper.exe

        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 25.1MB
        • SHA256 4cdf498049c79c943dd0ffc3361b7b7c6308c231d6cca63ddbb01cd68091483a
        • MD5 SHA1 SHA512 SSDEEP TLSH

        os_update_handler.exe

        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 25.4MB
        • SHA256 ebb0cf9f473413791a0327b08ffedb6e55ae38910aca57a8eb4ed4e84cbc187d
        • MD5 SHA1 SHA512 SSDEEP TLSH

        chrome.exe

        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 26.6MB
        • SHA256 92909753e76a6eaff2e186d591078a382b70d405f24d5fd6a3d6344c2dc5ced2
        • MD5 SHA1 SHA512 SSDEEP TLSH

        chrome_proxy.exe

        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 24.9MB
        • SHA256 d320bdfcc9a03df68b0c684d7e6712478cee1e8e24abfdb8477c183ddad112fd
        • MD5 SHA1 SHA512 SSDEEP TLSH

        appletviewer.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 23.5MB
        • SHA256 397927cae35d8b1ec3d07d89e3568de6e1f424a3247e8cfa9a1b511ab8b5644c
        • MD5 SHA1 SHA512 SSDEEP TLSH

        extcheck.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 23.5MB
        • SHA256 aed8de48c00211b6418aa30a661c5ab00526b5ba8f9988c0cda637c9b74f335e
        • MD5 SHA1 SHA512 SSDEEP TLSH

        idlj.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 23.5MB
        • SHA256 d9fb27e3c09ca347fb162a3104f3b7f9cc7d44def9156d93bb244057334288d9
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jabswitch.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 23.5MB
        • SHA256 e80a36a50f528dcc6e2e6bf3faccaa022eceab9b180c575ffde5138a5164cb41
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jar.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 23.5MB
        • SHA256 12fa701e94a12fdec4763caae513ffd7e1d55ef1f6a76fa7b936d77fd1909fe3
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jarsigner.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        • Size 23.5MB
        • SHA256 1d51de978f3a15d172c4dd7290ab756bbd586e25ee01f255d892cc4e7be1baed
        • MD5 SHA1 SHA512 SSDEEP TLSH

        java-rmi.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 23.5MB
        • SHA256 496e862b98ba4a9a79b837b68462dd2aa3eb7cec93f98477504b3f64eeed5946
        • MD5 SHA1 SHA512 SSDEEP TLSH

        java.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
        • Size 23.8MB
        • SHA256 27c1d45f4114374fab9fc8dc2a85822c47d1bf360ff3e8e405cfc6145caa3b3a
        • MD5 SHA1 SHA512 SSDEEP TLSH

        javac.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
        • Size 23.5MB
        • SHA256 ac8beb87adc1136d870c25be5095feac329052814ae69259b9f014c6d06d5da2
        • MD5 SHA1 SHA512 SSDEEP TLSH

        javadoc.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
        • Size 23.5MB
        • SHA256 c23e3c7852fcfe03a6d62c2190a619e16b8e7f83efdcb49c2d5cc7c864378d61
        • MD5 SHA1 SHA512 SSDEEP TLSH

        javafxpackager.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
        • Size 23.7MB
        • SHA256 2371bf2da11fe67918d09761655c5c3ef33012e488bd13aa25b1aa4985fd2849
        • MD5 SHA1 SHA512 SSDEEP TLSH

        javah.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
        • Size 23.5MB
        • SHA256 394e0c4b7b49798a8df153111948f0ab9e871cae5f62577813459c4acbcbcef9
        • MD5 SHA1 SHA512 SSDEEP TLSH

        javap.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
        • Size 23.5MB
        • SHA256 6cb909adcdbfb51ac6461dce34591d5506fafa59f30bb466e51d7482c8efc2b2
        • MD5 SHA1 SHA512 SSDEEP TLSH

        javapackager.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
        • Size 23.7MB
        • SHA256 eaf626a908185a2bfb9d4057023ec0909a7760ff64119af9fae3c9c283f23bdf
        • MD5 SHA1 SHA512 SSDEEP TLSH

        javaw.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
        • Size 23.8MB
        • SHA256 f6aa552a3a1e496807ddf7d32c3be8a6780ff5add511686296f7e07c88658fff
        • MD5 SHA1 SHA512 SSDEEP TLSH

        javaws.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
        • Size 24.0MB
        • SHA256 5eb8ba13d97fcbb6b154881cd85bb31f4f1ca2ce95cfd2178ae4eee5080262aa
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jcmd.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
        • Size 23.5MB
        • SHA256 3f530916bc8c6d556bfbcbf74cf35789a1711f6230a71634de838f7f6b92dbd1
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jconsole.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
        • Size 23.5MB
        • SHA256 df04640ff2616d02dfacbed6f56db4524284b0e867dfd993c62b5197d07800e0
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jdb.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
        • Size 23.5MB
        • SHA256 07b6413044f21fd49f42965f2c8b36b2a4a40c9ea83fe8a0ca1ed89297abb05b
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jdeps.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
        • Size 23.5MB
        • SHA256 a892484cd68ffaf4712ecd32a1ba7ca71516b14398bfe3cac0361b9189171941
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jhat.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
        • Size 23.5MB
        • SHA256 55a9d731309603d05736dd7376ba133f8d57d9b15f5c76dadb276760145d4f6e
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jinfo.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
        • Size 23.5MB
        • SHA256 7f47e8851c3026ffc7215cbcc1bf1ce249370a34c783b9411addc338272d1070
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jjs.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
        • Size 23.5MB
        • SHA256 db482f5497824a5ddd711c23f763a0c7b5ad37a28d248b8eccc8f2db9bb89880
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jmap.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
        • Size 23.5MB
        • SHA256 5bc58dce04b8896bfb1c0b23a6bfbb0c9582fc1175ab025efb3933211dbb89a2
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jps.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
        • Size 23.5MB
        • SHA256 9fd183c5265020b6e05fb67084b078938ca6805a6c1bcadf8933cb4b394ec39b
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jrunscript.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
        • Size 23.5MB
        • SHA256 a1be5bceef43117e6860a8bc718f90a4146cd0314c61c20afcb92aed4bd570b7
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jsadebugd.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
        • Size 23.5MB
        • SHA256 3eb32160abd65958607a30125f06ca1fb33cd09b577bfb624f8742181807be5c
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jstack.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
        • Size 23.5MB
        • SHA256 b375065c02b2cebfb427020780f4fb126c6b2f131a9035cfa5a485900e18f9af
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jstat.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
        • Size 23.5MB
        • SHA256 1165ab14a8d1e5f4ab9ee5645a50899c76657d60244c44fd71e379b0329f4d7a
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jstatd.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
        • Size 23.5MB
        • SHA256 60cd9f653adb6b2b6d4562acc799a030d1e6843f6811df3ce427dfd55ab9ca4c
        • MD5 SHA1 SHA512 SSDEEP TLSH

        keytool.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
        • Size 23.5MB
        • SHA256 824a1e70073a969228a098eafb2952ceb854d330df1b713a727bbca0a1d8c66e
        • MD5 SHA1 SHA512 SSDEEP TLSH

        kinit.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
        • Size 23.5MB
        • SHA256 8c57110f6ad14c0b66b14a45e1f937a584aa48ebefd0c3f096072cfce46b7baa
        • MD5 SHA1 SHA512 SSDEEP TLSH

        klist.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
        • Size 23.5MB
        • SHA256 0906c19a440c21f8b89736005a88f28a4ef65ec75419c0a378277a767adfa6ed
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ktab.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
        • Size 23.5MB
        • SHA256 dc7a61da85bbc7b69eb6881645a97be8521b1553ce3bfd77013822518ca68879
        • MD5 SHA1 SHA512 SSDEEP TLSH

        native2ascii.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
        • Size 23.5MB
        • SHA256 7f4e1674c8f7d349e65465b0518ba69f8188f58c10ca26bf1249881321256794
        • MD5 SHA1 SHA512 SSDEEP TLSH

        orbd.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
        • Size 23.5MB
        • SHA256 f0012ea9e5c975a94eef10b729e4c21b9333bef9b8fb3748a3197c9ac0a3b272
        • MD5 SHA1 SHA512 SSDEEP TLSH

        pack200.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
        • Size 23.5MB
        • SHA256 78415e6b143a1067d4a7b7404c5f3f0982ef7349bb20e6f5579b6d8de4ab9274
        • MD5 SHA1 SHA512 SSDEEP TLSH

        policytool.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
        • Size 23.5MB
        • SHA256 c5456fdfe46dece5cee571d458e2af3e3a5dbc94973732b6130f0c64d26d1a34
        • MD5 SHA1 SHA512 SSDEEP TLSH

        rmic.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
        • Size 23.5MB
        • SHA256 371c0ec3dce352ee441fba9274eed9a18dbfd7570e75ab93eee98493f092cfa5
        • MD5 SHA1 SHA512 SSDEEP TLSH

        rmid.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
        • Size 23.5MB
        • SHA256 ac79c9e33beda883cf294a83f9710947f5ad65ee30a803fba96488b66a1b174a
        • MD5 SHA1 SHA512 SSDEEP TLSH

        dotnet.exe

        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 23.6MB
        • SHA256 1411b6c5fa01aedbe41c5f73b77de668ea75935b280a9e767715db3146e0a685
        • MD5 SHA1 SHA512 SSDEEP TLSH

        createdump.exe

        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 23.6MB
        • SHA256 6fe8bf6446e99cfac097a79c98af71e7268f61a38ca0e0a8a7ade6192b170472
        • MD5 SHA1 SHA512 SSDEEP TLSH

        createdump.exe

        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 23.6MB
        • SHA256 2b861c1526133220d77be6dee3e4f319155ce868e831e50b739d200262062c40
        • MD5 SHA1 SHA512 SSDEEP TLSH

        createdump.exe

        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 23.6MB
        • SHA256 3eb3eb84b50ad764361f4697de3f54be20fb067806e717f0e92a407cee185f03
        • MD5 SHA1 SHA512 SSDEEP TLSH

        memory/3756-0-0x0000000000400000-0x00000000004E4000-memory.dmp

        memory/3756-1-0x0000000000400000-0x00000000004E4000-memory.dmp

        memory/5364-23-0x0000000000400000-0x00000000004E4000-memory.dmp