Analysis

  • max time kernel
    149s
  • max time network
    115s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260710-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    15/08/2026, 03:52

General

  • Target
    2026-08-15_5aed5ff67b1826efd8f414c37f314c62_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_stealc_vidar.exe
  • Size 11.5MB
  • Sample260815-efdl4sycjd
  • SHA256 3c75e0cadbc3b8d223ee01c6a8de5217913e902882fd3c609c01a12bef4c8a46
  • MD5 SHA1 SHA512 SSDEEP TLSH

Malware Config

Signatures

  • Drops file in Drivers directory 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • Sets desktop wallpaper using registry 2 TTPs 2 IoCs
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies Control Panel 4 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-15_5aed5ff67b1826efd8f414c37f314c62_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_stealc_vidar.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-15_5aed5ff67b1826efd8f414c37f314c62_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_stealc_vidar.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:480
  • C:\Users\Admin\AppData\Local\Temp\2026-08-15_5aed5ff67b1826efd8f414c37f314c62_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_stealc_vidar.exe
    C:\Users\Admin\AppData\Local\Temp/2026-08-15_5aed5ff67b1826efd8f414c37f314c62_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_stealc_vidar.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:364

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        InspectorOfficeGadget.exe

        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
        • Size 11.6MB
        • SHA256 98480335528b9dbadfebf2252812b3929e78d2587239fadc37d468236c35c6a5
        • MD5 SHA1 SHA512 SSDEEP TLSH

        IntegratedOffice.exe

        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
        • Size 15.6MB
        • SHA256 57d9593d51ee4076828544482d2b555ab56aa579c132649cc4b726bc894fb7cb
        • MD5 SHA1 SHA512 SSDEEP TLSH

        MavInject32.exe

        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
        • Size 11.9MB
        • SHA256 dfcb915a7ac9367abfbfcbcfdccecd035740a10bd95e884a772b81f8cb392870
        • MD5 SHA1 SHA512 SSDEEP TLSH

        OfficeC2RClient.exe

        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
        • Size 35.0MB
        • SHA256 ffe4885c9e3bc352f6a6abb0fecfda9a0f502fa135843a0d63e75444a00da5ed
        • MD5 SHA1 SHA512 SSDEEP TLSH

        appvcleaner.exe

        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
        • Size 13.7MB
        • SHA256 f441cfec4d24199f0e1de483f092bd75c528fa8d2bfc26b773ae2694a909754e
        • MD5 SHA1 SHA512 SSDEEP TLSH

        VSTOInstaller.exe

        • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
        • Size 23.2MB
        • SHA256 d6bae4dc4987514a62cb6257198b2dcb7a04f087a4c88b8bad9343391aee06ec
        • MD5 SHA1 SHA512 SSDEEP TLSH

        chrmstp.exe

        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        • Size 29.2MB
        • SHA256 3de01f05ddc66d955e22709e4db13acd76c2e1a61bb4fb2a90958730424d79b4
        • MD5 SHA1 SHA512 SSDEEP TLSH

        chrome_pwa_launcher.exe

        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 24.8MB
        • SHA256 b83c79e08d829ccca776e17552de8059f2baa792cee6989e34dfdfc68e17a119
        • MD5 SHA1 SHA512 SSDEEP TLSH

        elevated_tracing_service.exe

        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 26.6MB
        • SHA256 2b78bf57550ec83877cf81f5c1d7878805d49b7577ee0343fe015d130ec4430f
        • MD5 SHA1 SHA512 SSDEEP TLSH

        elevation_service.exe

        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 25.4MB
        • SHA256 db9c00088f5cea4763b832e51550b60c84bd781cbfff3081032432fd5a512987
        • MD5 SHA1 SHA512 SSDEEP TLSH

        notification_helper.exe

        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 24.7MB
        • SHA256 216c01eca759bc84185d28f6ec2a6a4c141e7e09654375e38effe4874e067cda
        • MD5 SHA1 SHA512 SSDEEP TLSH

        os_update_handler.exe

        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 25.0MB
        • SHA256 79e5c781edebafccb9312dffc2a11dc40cff7ee5fa62bcbfe032338dbe96f713
        • MD5 SHA1 SHA512 SSDEEP TLSH

        chrome.exe

        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 26.2MB
        • SHA256 7601b7abe46d9eb31449785a32f856cb35711b122d4b2d7ab6a51586f310fb41
        • MD5 SHA1 SHA512 SSDEEP TLSH

        chrome_proxy.exe

        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 24.5MB
        • SHA256 29a3b79edb7e4a604a4682c59908123829a7f3d036c152ae7b4b40c9fdec6be7
        • MD5 SHA1 SHA512 SSDEEP TLSH

        appletviewer.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 23.1MB
        • SHA256 4f50b67e30b4093b77e4032ec1b82241e6ce1207cc7990e544e1e595972218e3
        • MD5 SHA1 SHA512 SSDEEP TLSH

        extcheck.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 23.1MB
        • SHA256 b4018cf4c0ed29fe797437fabf8ce159e6b8515c088415155c4321d6bb55817d
        • MD5 SHA1 SHA512 SSDEEP TLSH

        idlj.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 23.1MB
        • SHA256 838433809659f66702076c99dbc84e726150eec37656956be4b4e5eedbaf44a8
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jabswitch.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 23.1MB
        • SHA256 9005e7cbd335f87641721a2118456e6d449cdf1aa9608f86c8933bbd3f0930ce
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jar.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 23.1MB
        • SHA256 244137d56d794613da41462eef04490467fb4d7767d79a02693adc2bb507de1a
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jarsigner.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        • Size 23.1MB
        • SHA256 f8de5bc942ed2918a43d20ad0bad6f69f4a751c169f2143f15e9833b00eeaaad
        • MD5 SHA1 SHA512 SSDEEP TLSH

        java-rmi.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 23.1MB
        • SHA256 a346fbec14646e70c4520bd09e2cdfd3b1b6b5edbd7e08d4bd0b06e5851ebe7f
        • MD5 SHA1 SHA512 SSDEEP TLSH

        java.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
        • Size 23.4MB
        • SHA256 10034d0f3677d44955a8246484f5cf4683b6b81b7800f369ceb5d188aa591186
        • MD5 SHA1 SHA512 SSDEEP TLSH

        javac.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
        • Size 23.1MB
        • SHA256 540e576c206dd4e868bac530c5b04da763aa9c7df59ae291cf0e84abf4009f37
        • MD5 SHA1 SHA512 SSDEEP TLSH

        javadoc.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
        • Size 23.1MB
        • SHA256 0a035c12eb86e72e3a5e3550473b8d3db5fb282d541ed0e1940f0c982e575fa7
        • MD5 SHA1 SHA512 SSDEEP TLSH

        javafxpackager.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
        • Size 23.3MB
        • SHA256 884ee481bdd77581cfbf2016837b431e14188e3aa9eb82f5311f10b2ec5c6f55
        • MD5 SHA1 SHA512 SSDEEP TLSH

        javah.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
        • Size 23.1MB
        • SHA256 6f196de332c2932899dc5c98e6886bc8102fbf391e5eb333674195ba5a44981d
        • MD5 SHA1 SHA512 SSDEEP TLSH

        javap.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
        • Size 23.1MB
        • SHA256 564a420f9ab22e9f3523b8567dc34c7765934856484088753900608bd03de073
        • MD5 SHA1 SHA512 SSDEEP TLSH

        javapackager.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
        • Size 23.3MB
        • SHA256 1e20e0e00351a954d71cbcf64be0b5b12708af719ff08cada11258d8123bdace
        • MD5 SHA1 SHA512 SSDEEP TLSH

        javaw.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
        • Size 23.4MB
        • SHA256 db9db4227d39724586eeec0ac2aa4e33bcf8c4ddcbde547623c70956d7c506ba
        • MD5 SHA1 SHA512 SSDEEP TLSH

        javaws.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
        • Size 23.6MB
        • SHA256 7e9afa46f6edc24f939dc722fda79f8d7428c75ae8a523b2901c0c2ed520fcb7
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jcmd.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
        • Size 23.1MB
        • SHA256 70ee2254958c21b9a20a034a138b6c7cf55e932e078d6931ac052b720954e842
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jconsole.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
        • Size 23.1MB
        • SHA256 ce0ec738ee99bf4e7ad5a203cb1443598d734400fc5b3ca87a037d75ee88a5af
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jdb.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
        • Size 23.1MB
        • SHA256 982ff66ec8db00709ff757a00f4e59a170214fce47feab8fc4acbc8a2b324a8c
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jdeps.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
        • Size 23.1MB
        • SHA256 011ecd259849a41243f4d37575390c0ff5335e3d0375aa6662d21a0d9ea17aa7
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jhat.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
        • Size 23.1MB
        • SHA256 3eff5d0e20fc9e28ade84a8c67a858ed943a8daadbe8cec7f6fc80e1438caddc
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jinfo.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
        • Size 23.1MB
        • SHA256 0810a80800f3401f974a59188a63c530e5d0323d708d0d39a52cc89855bd6c02
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jjs.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
        • Size 23.1MB
        • SHA256 a76cc2e1bfd6081ab883ef0ec554411e9d6ea552ac758bd21e2bb61214ef2980
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jmap.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
        • Size 23.1MB
        • SHA256 1ab82c314a41faca6643448505f1c332bc1cdafab281c69f843aa8bea34c1cc4
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jps.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
        • Size 23.1MB
        • SHA256 ea6f34b0c683ff1e1311147c15dbd0f744e786d7558febb4b88059f1bcc34d7c
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jrunscript.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
        • Size 23.1MB
        • SHA256 2878cd2508fcec760362859bdf8de726f133a98d6ab32948d7a5a10141ba47bf
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jsadebugd.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
        • Size 23.1MB
        • SHA256 83ba2b707ab33e0c1585a882a242dee8365ceb9c974e7826f71a7b9bc86732ac
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jstack.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
        • Size 23.1MB
        • SHA256 ada44efaaecb409e66bf51fd39ae83371047780530f2604f50ab0b925b0e459c
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jstat.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
        • Size 23.1MB
        • SHA256 2908d83912a3019f9852cc460975bdb0048d555cd40f2c79e8491e2bc966e2d1
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jstatd.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
        • Size 23.1MB
        • SHA256 d0bddb5fd4def8e10d7fb52cdb1de61f243fc264f113826a1640fd080431890e
        • MD5 SHA1 SHA512 SSDEEP TLSH

        keytool.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
        • Size 23.1MB
        • SHA256 2787843f432e8287bafff7a7197e2a9e04c3928f61b74db9e3e79a14c666cb3f
        • MD5 SHA1 SHA512 SSDEEP TLSH

        kinit.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
        • Size 23.1MB
        • SHA256 f4cb4c2e24e0a9cd52e032b9eb8feddfdea191d834a6264fb5613287a51a3292
        • MD5 SHA1 SHA512 SSDEEP TLSH

        klist.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
        • Size 23.1MB
        • SHA256 54fe6a6f983ef4f33e36262d23be76e7dbd290b41fc639168da989122c8874ba
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ktab.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
        • Size 23.1MB
        • SHA256 206784c32334196119a30b106b8052ce3d609fce5439b0cf25a5e4e4e1c8fa51
        • MD5 SHA1 SHA512 SSDEEP TLSH

        native2ascii.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
        • Size 23.1MB
        • SHA256 6eb5de3a765b52f76d36b3d0b595b799b3966ee3bd6d93f6f925431a582b7ff6
        • MD5 SHA1 SHA512 SSDEEP TLSH

        orbd.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
        • Size 23.1MB
        • SHA256 84dc281bf316ab41bee1f3e1a95140ee68d0e020cd15fcf6c6dcd7a67712b915
        • MD5 SHA1 SHA512 SSDEEP TLSH

        pack200.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
        • Size 23.1MB
        • SHA256 73ad9c2085d0ecfb8644945494499d02cc964c884a2ae3678db8a5735ec7b963
        • MD5 SHA1 SHA512 SSDEEP TLSH

        policytool.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
        • Size 23.1MB
        • SHA256 48dad78555d746dea0db313a3ff47d697a2c8a5fdfc6a868a2c9308df32fcb81
        • MD5 SHA1 SHA512 SSDEEP TLSH

        rmic.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
        • Size 23.1MB
        • SHA256 d9a83db8a77f02b0cec6690c315b2d245a446a2ba7d33ae6f6fadc336e401e91
        • MD5 SHA1 SHA512 SSDEEP TLSH

        rmid.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
        • Size 23.1MB
        • SHA256 53a03e12108528e610f8a491045a2731019b2050a648b4d4311de854c9362128
        • MD5 SHA1 SHA512 SSDEEP TLSH

        rmiregistry.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
        • Size 23.1MB
        • SHA256 c258c6de76effe8218561037d68c342b35b0ac069ece3067a93b8b892ad1864f
        • MD5 SHA1 SHA512 SSDEEP TLSH

        schemagen.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
        • Size 23.1MB
        • SHA256 4c11c348d82f25ca2deb7c68b43569720dc0233e66eb57a2fb939b957648e27d
        • MD5 SHA1 SHA512 SSDEEP TLSH

        serialver.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
        • Size 23.1MB
        • SHA256 b2838770cba22777839951f982d0432f1c68f262dfe5c1a5dffc8b6879697b4d
        • MD5 SHA1 SHA512 SSDEEP TLSH

        servertool.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
        • Size 23.1MB
        • SHA256 3fcf325f7c224dfe5e32ae46052b89a76a58641a2228227500e84f7fb4aae684
        • MD5 SHA1 SHA512 SSDEEP TLSH

        tnameserv.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
        • Size 23.1MB
        • SHA256 7d21826b3ef50209bd658491cc3d4b9c8a0ac609572240f3f3fa5c14d9fc1534
        • MD5 SHA1 SHA512 SSDEEP TLSH

        unpack200.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\unpack200.exe
        • Size 23.3MB
        • SHA256 581466022fa0648bcf313d0f31b4e6acf3a86d64fc3bbf208e25b5e59411ecdf
        • MD5 SHA1 SHA512 SSDEEP TLSH

        dotnet.exe

        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 23.2MB
        • SHA256 c796aa6a5b8ea1082bad33dedad698fb52b626b75d95ffc516d45a66b2122057
        • MD5 SHA1 SHA512 SSDEEP TLSH

        createdump.exe

        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 23.2MB
        • SHA256 4fd5d1edffd0df6078eb5dd7a3b016c0be3364fefdb731045ac7191163417dcb
        • MD5 SHA1 SHA512 SSDEEP TLSH

        createdump.exe

        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 23.2MB
        • SHA256 4270430504ff07661cae4bdc914fe33b6631962fe135d9c99df87e56405e0daf
        • MD5 SHA1 SHA512 SSDEEP TLSH

        createdump.exe

        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 23.2MB
        • SHA256 ac6d6b5eb5f945da0168caffe837ef2e9f6dbf58f22524f7cbb888787565fd47
        • MD5 SHA1 SHA512 SSDEEP TLSH