Overview

overview

8

Static

static

3

2026-08-13...ar.exe

windows10-2004-x64

8

2026-08-13...ar.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    66s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260513-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    13/08/2026, 04:42

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-13_6acc5ba4b9bff8396c738604163b4c99_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
  • Size 33.6MB
  • Sample260813-fb6mrssang
  • SHA256 67a4cdaeaa3959a6e0ac8d46c1517b374db42f9914ab4ef71a4b2e667ce4f62d
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
discoverypersistence

Malware Config

Signatures

  • Drops file in Drivers directory 3 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-13_6acc5ba4b9bff8396c738604163b4c99_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-13_6acc5ba4b9bff8396c738604163b4c99_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:3084
  • C:\Users\Admin\AppData\Local\Temp\2026-08-13_6acc5ba4b9bff8396c738604163b4c99_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
    C:\Users\Admin\AppData\Local\Temp/2026-08-13_6acc5ba4b9bff8396c738604163b4c99_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:4824

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        7zG.exe
        • Path C:\Program Files\7-Zip\7zG.exe
        • Size 34.3MB
        • SHA256 08cbce2a3686724d9ff8b98bc5a869c41d87739683869ca2be6d56a0bcc99b56
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrmstp.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        • Size 39.6MB
        • SHA256 5c34ef937f71bd3b6404dea768ca133839832ac8a38de0bbdee66bb6d5443845
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        setup.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
        • Size 73.2MB
        • SHA256 a7cb024429ba25960038b193fa01a226775b64fcdd7458de3223aebbd4f89261
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 35.9MB
        • SHA256 47604ca377d0d3a4724d650a5ccdaf684ea80f90f71f46069ad78ce4127e0c17
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notification_helper.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 68.8MB
        • SHA256 3accb8f13a85ea2440cc791295c943d97404ae360c2e9c20d5704ace7dbb47a8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        os_update_handler.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 69.0MB
        • SHA256 2ea8779fcd36b86e559fc50013ea215c4d88d0b9ec1d697c62273829fd45200a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 69.5MB
        • SHA256 1c855637d25ef1f784689a24f6fdf18f70363759129bda26cb7f75d0dba2dda4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 48.0MB
        • SHA256 1a19471c7dd5efde8038635591c970a650b4c3e45c550641f53964923ef95609
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 41.4MB
        • SHA256 1c1fc7df6a6c51efb8d80cb282ccbe602a95c0bd9c58f34ee3c4a99a7a8de3ff
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 45.3MB
        • SHA256 b173957c00e014e11ebb899c65a22ee5d7b79c9bd9e0f1e549b5e0745a849254
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 43.9MB
        • SHA256 15d8b796f8ac506457bb640f89be86c70b67e4003bbf9c2bf76faf2200eed068
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jar.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 40.6MB
        • SHA256 ca8cd6fc7968aeef2652ef64b5dbb1b4d268593fe7b0b5d9f1d1a49d795fad58
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jarsigner.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        • Size 40.9MB
        • SHA256 9fe9a6075c1add899ee890f91f4c2dadf71c2ab32555baee2159451dbb2ab021
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 41.1MB
        • SHA256 cda37168a83f1680f5e6cd8a8aead91bb2f760a881b4c4e975ff44ba29027bc0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
        • Size 39.1MB
        • SHA256 06dd058133de7c23ba47cf0e84ea72ec3297adbc2b66fbd091f6e5f7258b95fa
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javadoc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
        • Size 39.9MB
        • SHA256 9279dbb3edcfc8a4028af1911f75d2a6584ca30bd502796e1f57479ec1c9bfef
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javafxpackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
        • Size 37.2MB
        • SHA256 b22d04fd9f745bc1e3eb91b7c06427732e2f4745f6fe00470bdd049b3ca47d36
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javah.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
        • Size 39.1MB
        • SHA256 a05da1744647bc7ebd955bcc54b5e4f3eaf91f8453c69b610e3b93f0f4fea9e8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
        • Size 38.1MB
        • SHA256 d43f5a7527119ab16dbe5e93caa836ccd1f6c1c9773c92e7c14c986d94529a34
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javapackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
        • Size 35.6MB
        • SHA256 ae124d67a275b538d9d50fde7de758d8168917eb934b81101c1a19264db3c6c1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaw.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
        • Size 33.2MB
        • SHA256 8f694696202a4b47ff6704e7cdfcc2c1aca8b72a25ef023c90c529727548a233
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
        • Size 34.7MB
        • SHA256 3b7113d93779f1e1ec7a298b00cdef09b26d6269661df53f569c9d84a57fff23
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jcmd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
        • Size 32.8MB
        • SHA256 41954e1e4fed9847f25d683faae47ad819adf31bf92a9c3f13d8fea19738e2e0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jconsole.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
        • Size 32.6MB
        • SHA256 df5715488efbb7853a45a14fa871a2d4728d88c813cb311799672e7f0f50cc8a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdb.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
        • Size 31.9MB
        • SHA256 8f17e8b256d08e89bee6d0b9f4d3740bce51e88bfef60dab1888f7f487ab3a75
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdeps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
        • Size 32.9MB
        • SHA256 3a6e30bc1b1bb053b71eaab031735d14d1bee02f4f6ad89412eb28f986005f70
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jhat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
        • Size 32.2MB
        • SHA256 6acb0631c5107b0803aba0923a3860f1115fe4315492e113e7430e5016b4c0d3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jinfo.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
        • Size 31.6MB
        • SHA256 b964fb218ef607ea1d6edc9c3c17ea9a60d5d29906e26efa9832f968149d92c8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jjs.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
        • Size 31.4MB
        • SHA256 1055ae55f09188489ee71789c14ba1765648cabc90a096c111d690a2c7b43320
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jmap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
        • Size 31.3MB
        • SHA256 08d1a86a8e895ef2a6253fdfd6b5b268a328a2d67592b9b5d4bb2ef70ddc9d29
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
        • Size 31.2MB
        • SHA256 6fc47e9c2e589be9673299196097c8aabde9f030f65f08307909b2529a1c1028
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jrunscript.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
        • Size 32.7MB
        • SHA256 4ca24acf84b8b3a74cdce9303b1c45bbe07828698e44518d61dcdfa74ded621c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jsadebugd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
        • Size 30.9MB
        • SHA256 1db1c150021f9cae3a6d0144c3c7cd4c10f40ad09b100c52352aa06789cb2625
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstack.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
        • Size 30.7MB
        • SHA256 d753795af8e415e1fe6cb7b4c988e9bef3f06ddd06cb33ac91d5547f883e5ab2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstatd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
        • Size 31.6MB
        • SHA256 2e7f513688ee86424af9b2c7c2ccdf23cd821093cb9ffad5b23c1c1384ab7c48
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        keytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
        • Size 30.2MB
        • SHA256 0c11fcf2f2929c9cd8913bb9d3200e1d78a27ac732df6435518dc5df394ddb88
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        kinit.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
        • Size 30.4MB
        • SHA256 35c82797c4af38979af1fba734772f824dd06fb51d58ecf0d93e8c4739108395
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        klist.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
        • Size 29.8MB
        • SHA256 843af5e753b120ea0c4b36e1c8ec0cab9593be49d806d858eca691ffa9f94b6a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ktab.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
        • Size 29.9MB
        • SHA256 ea7793df334ab42b04c12b89bfae8ae6e15b8cb09dc61aeb6c36803389fac2d1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        native2ascii.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
        • Size 29.3MB
        • SHA256 5079a16f9e1cef312b8c1ef91f2d912bd23aa4b908c76a0963d7f42689922940
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        orbd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
        • Size 29.5MB
        • SHA256 47d65bb6b5b029652586b7c64cb2e1c05fb6449821ea47ac18873b222d76b3eb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
        • Size 30.4MB
        • SHA256 829309a2fe61751b89fea98320acf07c3f08aade81fd1f2b8230d77cf8c5e5c7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        policytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
        • Size 28.9MB
        • SHA256 5ffda3a2588cac13120566fe463696029cae5d3f58146fe8390bb82d0dcc93bd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmic.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
        • Size 28.6MB
        • SHA256 d59e664e25a2fe379adc086be3b330a9ead938beb358700911319892a7463996
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmid.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
        • Size 28.4MB
        • SHA256 204744c88a3a5edb75a9e5f8fc65f91332e9a8234aafc0de261eed41f785beab
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmiregistry.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
        • Size 28.3MB
        • SHA256 33ae40ec1156638d153c4f8a4aa91f2ec37d8db983d9fbbd84138740b8841923
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        schemagen.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
        • Size 27.8MB
        • SHA256 565237c73e7b72104df0954edf8d9c8b9a282f41c3de76f75200038803df8b70
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        spo0lve.exe
        • Path C:\windows\SysWOW64\drivers\spo0lve.exe
        • Size 33.6MB
        • SHA256 67a4cdaeaa3959a6e0ac8d46c1517b374db42f9914ab4ef71a4b2e667ce4f62d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/3084-0-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download

        memory/3084-4-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download

        memory/4824-5-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download