Overview

overview

8

Static

static

3

2026-08-13...ar.exe

windows10-2004-x64

8

2026-08-13...ar.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    150s
  • max time network
    154s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    13/08/2026, 04:42

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-13_6acc5ba4b9bff8396c738604163b4c99_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
  • Size 33.6MB
  • Sample260813-fb6mrssang
  • SHA256 67a4cdaeaa3959a6e0ac8d46c1517b374db42f9914ab4ef71a4b2e667ce4f62d
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
discoverypersistence

Malware Config

Signatures

  • Drops file in Drivers directory 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-13_6acc5ba4b9bff8396c738604163b4c99_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-13_6acc5ba4b9bff8396c738604163b4c99_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:4612
  • C:\Users\Admin\AppData\Local\Temp\2026-08-13_6acc5ba4b9bff8396c738604163b4c99_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
    C:\Users\Admin\AppData\Local\Temp/2026-08-13_6acc5ba4b9bff8396c738604163b4c99_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:3712

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        AppVShNotify.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
        • Size 33.9MB
        • SHA256 b95286501232c26f129498fea8398be908a9a705e096dc31ca5d2297426ba214
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        InspectorOfficeGadget.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
        • Size 67.2MB
        • SHA256 5a9eb24e613b6e7d2eb1ec099f9c6c016c740517871c52951c5ffdd471df184f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        IntegratedOffice.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
        • Size 71.3MB
        • SHA256 35e192652d897508d5e549193f1b7e2e88e2bc2989b6b7f35abd92639c227011
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MavInject32.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
        • Size 67.5MB
        • SHA256 e5378e3817da064e74613f0f87575548e80cd27f32bd226c664c1ba2635e31cc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appvcleaner.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
        • Size 35.7MB
        • SHA256 6679d224f2fedd9df4543dce0f9b0fcbe22fd7e33c67553c50dcf5fb53557b27
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VSTOInstaller.exe
        • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
        • Size 67.3MB
        • SHA256 dd9575ede000a4a7525b2c515c42dfecb5e96ffaed0d2a9d28a9cfa7713c8ab0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrmstp.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        • Size 576KB
        • SHA256 f3bd2dab7382b72175192fb3e9f89598203ba5c57a724633b594102fdf17e510
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        setup.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
        • Size 73.2MB
        • SHA256 a7cb024429ba25960038b193fa01a226775b64fcdd7458de3223aebbd4f89261
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_pwa_launcher.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 68.9MB
        • SHA256 f5f0fbe07906dd424294fa8c9653da85bf4f3805931cf026b055776dc97dc2f5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevated_tracing_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 70.6MB
        • SHA256 3d6697266ca6dd19cf6742550e1f1a18866681c11b8d8f705a5262f61a8f85b9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 69.4MB
        • SHA256 90ce1e073bc17d0d1fa221b2f848c2597bb0cf40e0e1c52c50c82f6f7b0326e7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notification_helper.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 68.8MB
        • SHA256 3accb8f13a85ea2440cc791295c943d97404ae360c2e9c20d5704ace7dbb47a8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        os_update_handler.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 69.0MB
        • SHA256 2ea8779fcd36b86e559fc50013ea215c4d88d0b9ec1d697c62273829fd45200a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_proxy.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 68.6MB
        • SHA256 1957db34c64b39a3ba71b8ddb22becc8279e7e20b6cc748e252c367b7e81c9e8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 67.2MB
        • SHA256 affeb8d5b1f9adf8b03c1931e68efd410c0f148189736d0dc3ebfd6f17716e3d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 67.2MB
        • SHA256 f9e0bfdb5ddbfc831fe3a93094e82252ec694d2070d911c32bf403c4f2924a0b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 67.2MB
        • SHA256 7f4dbcf57422d72c24629a9f68e1234ed3ae3da71c6d95bde4bbc1996cc14920
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jar.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 67.2MB
        • SHA256 ea76e779da824bdea1edd317062183e8b2a151455b6f29f2f0aab2ef034e4032
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jarsigner.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        • Size 67.2MB
        • SHA256 6d7ff7407a4d26eb5e8dba741f3ca57d0aa0a09cdc63bc6f1a6e70d016d9c506
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 67.2MB
        • SHA256 352faed0d8e296cd5598f46327a559980fe1ae67936a96ddb059467fc7051d86
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
        • Size 67.5MB
        • SHA256 5377ccd43f93e6c06ccd686cbfccfeed9230d5f0d9a915e82bad4f22c6a3ae6d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javac.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
        • Size 67.2MB
        • SHA256 53d6385f0a41b777649295c4d56d7c7d542041959ba4e47291242fb1e4dd0a73
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javadoc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
        • Size 67.2MB
        • SHA256 e36dac144b546237eb86ab8a99edb9643d3bf4ed7e60deb225b346663cfb9c7b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javafxpackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
        • Size 67.3MB
        • SHA256 087097efba2449fe31d66388efdec3d25df6a22abe2d37811cab340ee9204063
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javah.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
        • Size 67.2MB
        • SHA256 99d2de047b603df01ddd95280e319f35c1ff106d3ad8f434b125863339c7a35e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
        • Size 67.2MB
        • SHA256 3f5487e74fb20f36149a1cc71a90604ceb694709d672ff062cff93ca9f8a5894
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javapackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
        • Size 67.3MB
        • SHA256 3e60fc2d61a5efa1debcf4d82d772b7a183d09b126cfaa6b17b7552014ac704a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaw.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
        • Size 67.5MB
        • SHA256 b46e948c162ed84e47133480f38ac9da54d40fdfe57a813fd3c3fafe50bc60e0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
        • Size 33.6MB
        • SHA256 4faaa90d9fa77cc38e6dae641fc3e8d493ddba948c3115572054f289ebf7e41e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jrunscript.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
        • Size 28.2MB
        • SHA256 f84c31347e2a66bbe26bd8ca715e8254a6ff682ba6dfb7151872ec41c1cc183b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jsadebugd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
        • Size 15.5MB
        • SHA256 3daed12023b68c61a640da6fd7a68d323ad9a53ea7b23812befa01b25e6d0fd1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstack.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
        • Size 13.2MB
        • SHA256 98fff973eeca8b94128477b9ae2f3aaa10d001bee7c5736ce95f743c1b6e6172
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
        • Size 12.3MB
        • SHA256 97f8f5111fc2b64a8abb170816b58330155dca112c87590dc3e2eb6d0f834948
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstatd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
        • Size 9.2MB
        • SHA256 e76c458ed65dfd67deb4926dc509fe372dcaedbd31bc10f430c926be2fa1dfbf
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        keytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
        • Size 8.4MB
        • SHA256 e02be8185a95508579598f0015e9c64e11705f5002335309ed4c5cef7b87c70e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        kinit.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
        • Size 6.9MB
        • SHA256 fc70ed815f566e39dc5ba1ac2633da3c82a4b0214aaa80e3f4ff875d9b73e7f3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        klist.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
        • Size 6.1MB
        • SHA256 7ca7430a16c2d69d540e85bd7bb276395db9d66df16853fa48422c9cc78020f6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ktab.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
        • Size 5.4MB
        • SHA256 636b80684be5a577a67a28482ed3708587a2dcfd5c3d4f0286a75234781543a2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        native2ascii.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
        • Size 4.6MB
        • SHA256 6446710f70bc39daaec1f8a38d93f0cd39e54d78b68f110569f9bc699e80914c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        orbd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
        • Size 3.5MB
        • SHA256 26c8d90c425fa512cf82d0b0a945009f4902e6f370e56d8cfada61369f5daff8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
        • Size 3.1MB
        • SHA256 57bf6ed75212758db71883b6e23bad622a681111c0e304cfd6d34903c431372f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        policytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
        • Size 2.8MB
        • SHA256 02d59e1fb3471b0c2abcf99f5b5c4ebb674e7b2d53eb43557a22181c3b262189
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmic.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
        • Size 2.2MB
        • SHA256 caab0a1c998e61be54c733ca5b2d4a60b91aad9979dbe48d6d1fbffb4e7b54fd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmid.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
        • Size 1.8MB
        • SHA256 4c72f24de3120b17740a0a72fc86f2d6ecf7c47e8b5b17d75d80a585cd5ecf2d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmiregistry.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
        • Size 960KB
        • SHA256 e06b59500ce9e383ee9c96ab13eadbceb686d601eef8b9058024805329a79ed4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        schemagen.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
        • Size 1.1MB
        • SHA256 504f372e43699f8fc8267bfd0cd191eda95c6b202453a707e2aaf72e6804b2bb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        serialver.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
        • Size 832KB
        • SHA256 537b71956121b63b96188d49c7b84db6e563b66c7e596e2d275c006bb7424168
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        servertool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
        • Size 512KB
        • SHA256 54a9cdeaa70d56716fea0c2b033f8174b1495f38e428abc781f5cd97cc816efb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        tnameserv.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
        • Size 192KB
        • SHA256 cc71df767f30aa32b4d730d3c0244896e3d45eb216f18568c46371d93640cac9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dotnet.exe
        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 67.3MB
        • SHA256 8550e87f246f889a95a334515f78051c70075ec7ad263a01173ce8463c2ed9d1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 67.2MB
        • SHA256 135779717adeb34e2195f974c58c87c078c62650f61a6f8ab785708ef7e82f31
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 67.2MB
        • SHA256 4222ea6c1fcaac6c1c4b6d785604de471106ba73f1033d20e402ff14e4dfa9ae
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 67.2MB
        • SHA256 45bf5b3df34b02206707d83289cf075619506a9dfd4d768b6966b0c8c482f725
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/3712-28-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download

        memory/4612-0-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download

        memory/4612-14-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download