Overview

overview

8

Static

static

3

2026-08-13...ar.exe

windows10-2004-x64

8

2026-08-13...ar.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    24s
  • max time network
    141s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260710-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    13/08/2026, 02:48

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-13_f6f0520ea8f6c28096c6a853ca751071_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_stealc_vidar.exe
  • Size 24.6MB
  • Sample260813-dakykaaj71
  • SHA256 b915376b8097011c97c4a1088da86f5a13ab6c99e9725087d990624767adf440
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
discoverypersistence

Malware Config

Signatures

  • Drops file in Drivers directory 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-13_f6f0520ea8f6c28096c6a853ca751071_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_stealc_vidar.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-13_f6f0520ea8f6c28096c6a853ca751071_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_stealc_vidar.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:1248
  • C:\Users\Admin\AppData\Local\Temp\2026-08-13_f6f0520ea8f6c28096c6a853ca751071_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_stealc_vidar.exe
    C:\Users\Admin\AppData\Local\Temp/2026-08-13_f6f0520ea8f6c28096c6a853ca751071_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_stealc_vidar.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:4292

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        MavInject32.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
        • Size 25.0MB
        • SHA256 b39d6d2be3734f6f880da078024d44fe5748c6f694d9c866145a4d623172c647
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        OfficeC2RClient.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
        • Size 72.8MB
        • SHA256 7e04ba701f2baddf958562c7a868e4e0ff85304d03fc5b2b4c38458927f8366b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appvcleaner.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
        • Size 26.8MB
        • SHA256 3496085ce1a1d8ece6d14c434ea65070504422bda8493c0893f3aa72547b1fcd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VSTOInstaller.exe
        • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
        • Size 24.6MB
        • SHA256 b915376b8097011c97c4a1088da86f5a13ab6c99e9725087d990624767adf440
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrmstp.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        • Size 40.4MB
        • SHA256 6b93c7713cc31a84c7d16bd4eb87e87256322d590aeee0193bd946089a85ba6b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        setup.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
        • Size 39.7MB
        • SHA256 a5967cd07a8027f84f093c6ce91762f6270c7bc2a429fec26acf994cfd00b41a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_pwa_launcher.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 26.4MB
        • SHA256 befb08dbaaa146eea17f6963bff7ad21e78994d803712d90f7050e4ac4eeb10a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevated_tracing_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 28.1MB
        • SHA256 c1072f72940f9842b656a3353fea7263e0f9302d94ad21b867c5f331fcdb6028
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 43.0MB
        • SHA256 c91f821c5f028c868701b7eaf7d0af90ac1d9fce7750a37dde66b543ae7cf1f9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notification_helper.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 38.1MB
        • SHA256 27843702f98e10f0049326f624f2eefa784410df9c7a49a357f8fcf739c92ef8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        os_update_handler.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 37.4MB
        • SHA256 ed641028aa278d887437ea4dd80a3642370ff95a70f2b668c16fdd954d29c990
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 36.7MB
        • SHA256 d4f29f6cb831ff21d6adacb1551c8ff37021dc26f58cdbe561eb9d5d04dbb549
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_proxy.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 35.6MB
        • SHA256 30a3f4aa60dc6bb02345537831519847e1945ab322fce71b92111c15b82cb553
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 34.3MB
        • SHA256 484e2369ade35ddd1cc8ab68e814a269bb95d3ce82cf985954e845ab918ffa8a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 33.9MB
        • SHA256 0dfbb1cf66c93198a8cfc9e63fb36a65e1c92c33038fdad5e4feb96b75695267
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 33.9MB
        • SHA256 5abec61ad53b4734b5cfa1d0e9bdd8691305dd35b6c6769fa9ddea670ed2bf15
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jar.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 33.6MB
        • SHA256 852f4cfab7d37f9643ad94e1c00491d4a9c76ed87dcb50565cc4d42b2f9bccff
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 30.8MB
        • SHA256 13e3293f5e7b27625e952fecf6eb9f2fe95bb927f1899786d3a09cb951a1b56c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
        • Size 33.4MB
        • SHA256 44f3f3e4fb1613c439bb7d2d4d715ba14303c171c07c08cbd799f90d7f2a3b1f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javac.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
        • Size 33.3MB
        • SHA256 b5fb0367ff694344bd461e43f36d174db50f2ef63d61337910d802e318e97425
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javadoc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
        • Size 32.9MB
        • SHA256 9cf6739dda918df1678ed0e2084a2d7c5cbaa520a7d30482d8eb9870e121cb1b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javafxpackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
        • Size 32.7MB
        • SHA256 8a91ddd03b73f078da167f2a9b0c3474b0926f2abc07e6d6ab3a16653ba7c074
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javah.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
        • Size 32.6MB
        • SHA256 1f4f1592ccff43ec6e6086ecd5965c61dece872d106f2e8b592b34a0a13aacb0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
        • Size 29.7MB
        • SHA256 f5d73b6622d286cd1af0bb7afad281bee6114bcce223ce7ae25a86b39a058ac2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javapackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
        • Size 32.5MB
        • SHA256 57d2a353ccd4bba801ed9fcb2986a2ec94db6d4a029e1b7c01611bcd16b998d2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaw.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
        • Size 32.4MB
        • SHA256 ee8aa5474ab0b521eee2620afc15f18d0fb6983fdba52c5b7b0f5476b0cc3352
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
        • Size 29.6MB
        • SHA256 08b12c42ebd32c6f1f0e2af94f1768a61236c8f21aa6aaf403b1a7617354df0a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jcmd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
        • Size 32.2MB
        • SHA256 9e69019a4d6745c3800c8916ce9d9f4c7e86a5fa0b1c1cf85dd771b0db0bd25f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jconsole.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
        • Size 32.1MB
        • SHA256 034c72a9992adf4b0b2be3103d15d187cdfe68ebbbf7641fe980c6af1fdac819
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdb.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
        • Size 32.1MB
        • SHA256 637d92e71b447e7248830105013eabf6d8f199d752c1f1bfdd42d808c47e3000
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdeps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
        • Size 32.0MB
        • SHA256 ed13bd300c47a751267e95152c2d03562e8c2bcfc2a649e0415f09a74588e3c1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jhat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
        • Size 31.7MB
        • SHA256 318a332c3bacfba8ca9b1107332f30c1724318fbd5fd5a664993f07ff894c3fb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jinfo.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
        • Size 31.6MB
        • SHA256 0c8f19ac17865225f2adf6825b36411f207c5cbb55409df53365b14bf49535f0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jjs.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
        • Size 31.5MB
        • SHA256 62f313ecd6ac76deba5c77cfa222a24e157132305ff494e4277054d01766a9f8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jmap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
        • Size 31.4MB
        • SHA256 85afa914607efb364fe1f4b513b601d7f90896619ac0c4794644061f5ddf2900
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
        • Size 31.4MB
        • SHA256 ba1bb10fc2e8e029c723c6cc2a9eb81bcdd5c157c8ba6985cbaf5b13e9879bbe
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jrunscript.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
        • Size 28.6MB
        • SHA256 21d053df6f65e04049dc4b2a6fab40b0f21d46a6cc81b672213de8e7062f9eb3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jsadebugd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
        • Size 31.1MB
        • SHA256 5fa08ce1e1d40a61b255a0460a89dc64fc3d51bc4bb50565088cad70b58dc03c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstack.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
        • Size 30.3MB
        • SHA256 077ca2cd709101fe1730c226036a79e236e1c134e6695eaa7c00c33aa6970006
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
        • Size 30.9MB
        • SHA256 4654db94a2a00403dc4fe62feb6e8a7d96619c1c7c17863ba4891314f55541d4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        keytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
        • Size 27.2MB
        • SHA256 2b936f73c434ec09ca86cbe33d3fcfb45062b113564473d4967927fde6637694
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        klist.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
        • Size 29.1MB
        • SHA256 ec3f8179ae83a5ed4a8c30fe74e80d715a74d9e47c84167b98803e9b1b06eae1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ktab.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
        • Size 28.8MB
        • SHA256 63d145d1e11edb5b078dc1c31b3bb89d76bacdf2d5dde61baa5ce778483d22f5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        native2ascii.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
        • Size 28.3MB
        • SHA256 7de77c59667b8ce5c1a4d8a716f94cadfa1761d639cb10d2aeb7ec9ea3c64e5f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
        • Size 28.1MB
        • SHA256 aaadcebcb3c4c310305030a001829af707917825330ff90f514900697f1a592d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmic.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
        • Size 28.1MB
        • SHA256 1c049f4c7b5df45ed12a0a95be3e64ceeafa804298ff3e2fc298b86605aba857
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmiregistry.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
        • Size 28.0MB
        • SHA256 6235754fe7bbe8dc7a062aed8684822351bd9c57785618f6c6053cbe0fa3eefd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        schemagen.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
        • Size 27.9MB
        • SHA256 a2d45e0361bf70b77293a13092719e25143a35515372939e12645ac85c2e732c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        serialver.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
        • Size 25.0MB
        • SHA256 881f3395fcf673915bed328d7107b6878a73ee2fb8727e9c5c8ed13f311d632e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        servertool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
        • Size 27.8MB
        • SHA256 dc8a082f19dd545170d7081892298605a3feb310e0a4fd19f48d322bf5bd5d73
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        unpack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\unpack200.exe
        • Size 27.7MB
        • SHA256 555452bf6d6164fe9f116305e72bf24e9204eb399aabf60523a9be0b39bc44f5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        wsgen.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
        • Size 27.6MB
        • SHA256 39a6015166386d34d8b0d9e98594660365d21dfd6c263ee518558882bdc3c27c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dotnet.exe
        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 24.8MB
        • SHA256 088a26859ba6f9f9572689b051654e7f94a795de2b136240071d9f83dc14125d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 24.7MB
        • SHA256 36bbd28827321ea5253442adbfc466ecc4adc1dc734d6b2dcc9ec10a2a2b06aa
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 24.7MB
        • SHA256 74bc234b9a45432c1d80e1c41f80f55162376eaa56c7d3bf7410218ee17f5167
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/1248-0-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download

        memory/1248-1-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download

        memory/4292-16-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download