Analysis

  • max time kernel
    149s
  • max time network
    147s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260513-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    15/08/2026, 09:50

General

  • Target
    2026-08-15_0d1aaa8a9cd52f4d254e3472ba6dfad6_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
  • Size 11.0MB
  • Sample260815-lt6ndafa87
  • SHA256 6f4d6021d1593b4d3cf7c555566b12b48b34525f7832e4523d6843cbb67348ee
  • MD5 SHA1 SHA512 SSDEEP TLSH

Malware Config

Signatures

  • Drops file in Drivers directory 3 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • Sets desktop wallpaper using registry 2 TTPs 2 IoCs
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies Control Panel 4 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-15_0d1aaa8a9cd52f4d254e3472ba6dfad6_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-15_0d1aaa8a9cd52f4d254e3472ba6dfad6_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:4980
  • C:\Users\Admin\AppData\Local\Temp\2026-08-15_0d1aaa8a9cd52f4d254e3472ba6dfad6_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
    C:\Users\Admin\AppData\Local\Temp/2026-08-15_0d1aaa8a9cd52f4d254e3472ba6dfad6_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:2500

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        7zG.exe

        • Path C:\Program Files\7-Zip\7zG.exe
        • Size 11.7MB
        • SHA256 b6cc81d94cabfda528b8882f826d32e01b0954b831e54da5ca459f551254272d
        • MD5 SHA1 SHA512 SSDEEP TLSH

        VSTOInstaller.exe

        • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
        • Size 11.1MB
        • SHA256 dd6eea527a64965ba993e38bd5f333b6c042cb0e44dd055b9335b4d750547d58
        • MD5 SHA1 SHA512 SSDEEP TLSH

        chrome_proxy.exe

        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 12.5MB
        • SHA256 d568ee1205b54616cdbd17958ee9f95c30743cfb1e5a62d4329e28a0c250f9ad
        • MD5 SHA1 SHA512 SSDEEP TLSH

        appletviewer.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 22.1MB
        • SHA256 50f9c8b2d93b217b1dec58965920cd5c04b5223e9ce7ec7b1a4f3e945b23ff57
        • MD5 SHA1 SHA512 SSDEEP TLSH

        extcheck.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 22.1MB
        • SHA256 04883999850b2e86b09800b1252037f61ccf2fc2ce65e835211931418b2fcc96
        • MD5 SHA1 SHA512 SSDEEP TLSH

        idlj.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 22.1MB
        • SHA256 2b89af5947d5e1455441af6e20e99b7037638da967e5019184c5eabea82ce87f
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jabswitch.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 22.1MB
        • SHA256 f29fb0cf29f9a7e40a50cb13263683969bb5546becffa9ea6fdc35df85a23642
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jar.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 22.1MB
        • SHA256 52a57407278a697dc71fd549935c826a735566bb0ce226fa430d9ae1b5b07df2
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jarsigner.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        • Size 22.1MB
        • SHA256 89c652e7b0d7a1316462cc335f8270a64b4d49a2a37e52d11e6f8e657c07778a
        • MD5 SHA1 SHA512 SSDEEP TLSH

        java-rmi.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 22.1MB
        • SHA256 bbead9f48874ee50852efe8432ba788fda3856cbe7f90febe38c26d32dd701cd
        • MD5 SHA1 SHA512 SSDEEP TLSH

        java.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
        • Size 22.4MB
        • SHA256 0a798361569c3cc0032571226a1997b52dac8ef75ded82539607a54524dc3f1f
        • MD5 SHA1 SHA512 SSDEEP TLSH

        javadoc.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
        • Size 22.1MB
        • SHA256 359db39558dce4602a64b387bf1cfc38d78bb03acb0fe38308ec962fba8ddf09
        • MD5 SHA1 SHA512 SSDEEP TLSH

        javafxpackager.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
        • Size 22.2MB
        • SHA256 36ae135f70b0918ac9f66d80c675cb1820b41630d91b0edcbda0187ed372a9a9
        • MD5 SHA1 SHA512 SSDEEP TLSH

        javah.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
        • Size 22.1MB
        • SHA256 38453a16ed722d192cee6b6e742de81b90943eab97b6de1168354325779b1534
        • MD5 SHA1 SHA512 SSDEEP TLSH

        javap.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
        • Size 22.1MB
        • SHA256 c16db4d6c99e1b3b322cd94da7128968750a8880b37a6add0d80ad6e19d513dc
        • MD5 SHA1 SHA512 SSDEEP TLSH

        javapackager.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
        • Size 22.2MB
        • SHA256 56925133474c2b5a09f0a7350e784a1fdae6c6d9ae0a8bdd6786915f8282b759
        • MD5 SHA1 SHA512 SSDEEP TLSH

        javaw.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
        • Size 22.4MB
        • SHA256 ebeead591b3aef9003313affbdeb23fa468eb38935b1e6cae4054dea6d7653a3
        • MD5 SHA1 SHA512 SSDEEP TLSH

        javaws.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
        • Size 22.5MB
        • SHA256 1f6ab14506565a9fb90252e469254afee135c628be1d4534e141ff09b4901b44
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jcmd.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
        • Size 22.1MB
        • SHA256 4f7397b52171f822c951a5754d5d4305a3829928de9214ac3ab6070c21dc19bc
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jconsole.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
        • Size 22.1MB
        • SHA256 880872b1acef64c6c4a3c18fae00267e1879c94bec340a5f6dfc3419f0d99894
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jdb.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
        • Size 22.1MB
        • SHA256 190b90c80204510bfa3e85daa41d0a3ade694ee2d96ccf02d49307fc0062bb4d
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jdeps.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
        • Size 22.1MB
        • SHA256 e4daed8d7414c57bd880fe8c1f20d1d5d46a7843c254256ee494748b0ec556f2
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jhat.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
        • Size 22.1MB
        • SHA256 cc7e773b4642aa856a5b8463bbc1f864597140c4208f794bd0e826ad2ed3900b
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jinfo.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
        • Size 22.1MB
        • SHA256 b867ee686b01529d2485834b6bd5c4982545cb10c5c8f5c73aafad10a32dd7e5
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jjs.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
        • Size 22.1MB
        • SHA256 9eed2b9cda0195b4c36bb4d2a8dc6c171d00f0d1a437a963a1252103c1f54214
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jmap.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
        • Size 22.1MB
        • SHA256 2835ef6c14b9b63c06239df983e8c77700071ba82fbb6e38c284e17cfb94f8ac
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jps.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
        • Size 22.1MB
        • SHA256 079d32c75bf018151bf3d7e89d8a03b9e04646278b3ffd5c69c1130d36ed11af
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jrunscript.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
        • Size 22.1MB
        • SHA256 7b2cb5556cf1641081d7530c7c58ea07e73294bb490deab245ffcf5e7538e39f
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jsadebugd.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
        • Size 22.1MB
        • SHA256 858312c79fd167b2cdf982ebe51ae1e9001b1e6250ca5862b245f3d440e79c72
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jstack.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
        • Size 22.1MB
        • SHA256 6efe5684a24ff7d27138b9a1ea2fe3e7ae2bd9ae1787c2bec37dc39e1d7dd413
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jstat.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
        • Size 22.1MB
        • SHA256 7fd86bc9d56fad72ce2f8c06c9002a97cfbce44d2ddfbcd921606b8042fd5e18
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jstatd.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
        • Size 22.1MB
        • SHA256 64057cf25c7d142e169eadba60d52680ca6186db3ed45a59878c82528f7374aa
        • MD5 SHA1 SHA512 SSDEEP TLSH

        keytool.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
        • Size 22.1MB
        • SHA256 cd8024db5ae58c1a260ed660c0bfa4e2e6fb5d222843aaf8bf4ebc931374c107
        • MD5 SHA1 SHA512 SSDEEP TLSH

        kinit.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
        • Size 22.1MB
        • SHA256 975d221c557e2e5d99f2f63dabadd3fb57ee62f3d5f917909fff4db7b7c4a38b
        • MD5 SHA1 SHA512 SSDEEP TLSH

        klist.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
        • Size 22.1MB
        • SHA256 adc1ecec2b09f185dbc7e7dace18f335701d875f45fe29c12fb8fcb12b735933
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ktab.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
        • Size 22.1MB
        • SHA256 f9bb197c42fc3cb2677ea41e8cc50a685adf110e9eb6db2f68ebf29e267682b3
        • MD5 SHA1 SHA512 SSDEEP TLSH

        native2ascii.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
        • Size 22.1MB
        • SHA256 c6a26d2b160e7cf460a6c511af05fd1937cf7fd7c87ebde1655abc7d1ce42bba
        • MD5 SHA1 SHA512 SSDEEP TLSH

        orbd.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
        • Size 22.1MB
        • SHA256 d6c3ea14dbd716158b9012c4858ca6d8dfcac7e92c5fa5ea37f71fd6a4401be1
        • MD5 SHA1 SHA512 SSDEEP TLSH

        pack200.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
        • Size 22.1MB
        • SHA256 866368c8afea94348368a8930c04354cec3394328a8fe4ca972d25d1c864144a
        • MD5 SHA1 SHA512 SSDEEP TLSH

        policytool.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
        • Size 22.1MB
        • SHA256 a8e38898b0ee2ef8c4573569dfea4f9541b890dd824aa4f3ea791e9f8d8024e8
        • MD5 SHA1 SHA512 SSDEEP TLSH

        rmic.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
        • Size 22.1MB
        • SHA256 92ce64020124b3b5fe565a94ad7fd05630f2d686a131fd0efb56d617b2da5e95
        • MD5 SHA1 SHA512 SSDEEP TLSH

        rmid.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
        • Size 22.1MB
        • SHA256 8241cf53798c5da9c17841ae9efda028b7df3d746cff0f6d6205d72a070808d5
        • MD5 SHA1 SHA512 SSDEEP TLSH

        rmiregistry.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
        • Size 22.1MB
        • SHA256 88e530089961f67196a2424586871eca2a00021e39d68ab89f0580d5ef9fe614
        • MD5 SHA1 SHA512 SSDEEP TLSH

        schemagen.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
        • Size 11.1MB
        • SHA256 bd1958bb0e4fe825c8223f66ab8355a1e19f947e4965afedd8607598a33af329
        • MD5 SHA1 SHA512 SSDEEP TLSH

        serialver.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
        • Size 22.1MB
        • SHA256 3a5783c4382206151333cc262cf8ab5012dcf9860a3c84747f8a791663cf2083
        • MD5 SHA1 SHA512 SSDEEP TLSH

        servertool.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
        • Size 22.1MB
        • SHA256 a3323666415b3b0b4fe8803f31e82f09adc41e82aa9e3777f69370f0786470fe
        • MD5 SHA1 SHA512 SSDEEP TLSH

        tnameserv.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
        • Size 22.1MB
        • SHA256 b85ba7a515a3f158e4f18db090f87c575e0c3ccd172b80e35125a43e8ff3c550
        • MD5 SHA1 SHA512 SSDEEP TLSH

        unpack200.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\unpack200.exe
        • Size 22.3MB
        • SHA256 ab30a51ae15c51e3ff6b5c4789fa8a16303d4e1a8271ee8ac472f83c5970bf6d
        • MD5 SHA1 SHA512 SSDEEP TLSH

        wsgen.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
        • Size 22.1MB
        • SHA256 26b07bd3556e257d29ba4f9e0359ddb50716774e6a0b722db13823cc3ee23b70
        • MD5 SHA1 SHA512 SSDEEP TLSH

        wsimport.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
        • Size 22.1MB
        • SHA256 83ef72940165af88fb52981dd3eeded1151ae460d2647ffbb45e7c70c08998a8
        • MD5 SHA1 SHA512 SSDEEP TLSH

        xjc.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
        • Size 22.1MB
        • SHA256 bbbe925e6ddc9451550df6ea45d7136e5556b971fdff1f9d9a19be0080d0c5a6
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jabswitch.exe

        • Path C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe
        • Size 22.1MB
        • SHA256 d73b722f68efbdcc9c239b368a800498720e9e036a481ea014fd1950f9e6ec1e
        • MD5 SHA1 SHA512 SSDEEP TLSH

        java-rmi.exe

        • Path C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe
        • Size 22.1MB
        • SHA256 3026e0640d45068d667e32553ca31dc7e008b463878b5b8f95c118e58131a702
        • MD5 SHA1 SHA512 SSDEEP TLSH

        java.exe

        • Path C:\Program Files\Java\jdk-1.8\jre\bin\java.exe
        • Size 22.4MB
        • SHA256 48af372c2a9fdcae414220fa4f6a043a6e7f4fdb1aa94a2ff5d11dc9d46a35a4
        • MD5 SHA1 SHA512 SSDEEP TLSH

        javacpl.exe

        • Path C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe
        • Size 22.2MB
        • SHA256 289e5fc70be5189b85bfcab98058b91a8283cfd3d3181ebd3733329ad71a454e
        • MD5 SHA1 SHA512 SSDEEP TLSH

        javaw.exe

        • Path C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe
        • Size 22.4MB
        • SHA256 85c6595c5a8be935f4eda4d30cf8e9c9f681cfd8d2951ab80146784df9952122
        • MD5 SHA1 SHA512 SSDEEP TLSH

        javaws.exe

        • Path C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe
        • Size 22.5MB
        • SHA256 bb58079d0bfc8033d1782a974100e7e94b338190f521927aba38261efe54d5a2
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jjs.exe

        • Path C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe
        • Size 22.1MB
        • SHA256 01e4f66f1068d23484e84f8ec5b5a494f7f3ab44dde39e4b12e74159d7075e8e
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jp2launcher.exe

        • Path C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe
        • Size 22.2MB
        • SHA256 50fa7269e1e77605b861fe696e09aa23d36df37904dfe8036e50ffe81c85da94
        • MD5 SHA1 SHA512 SSDEEP TLSH

        keytool.exe

        • Path C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe
        • Size 22.1MB
        • SHA256 e5951dceedeb41fcd23208ca5d9d488bb42857445b8d99b71a7ed0df3534f40b
        • MD5 SHA1 SHA512 SSDEEP TLSH

        kinit.exe

        • Path C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe
        • Size 22.1MB
        • SHA256 05452a94316a43916656ef51b7f6dcb6e3b5701ab8b440946442f7115004eb9d
        • MD5 SHA1 SHA512 SSDEEP TLSH

        klist.exe

        • Path C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe
        • Size 22.1MB
        • SHA256 f4a69886d171be0b1e3f7e9bd39a955c6e0d80ed518418aed48f2ed5ba0f6ab5
        • MD5 SHA1 SHA512 SSDEEP TLSH

        dotnet.exe

        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 11.2MB
        • SHA256 9887db8c95db0827f54418500fa3417dd105ae60bacb2e4cabbe6f54a4b2fc62
        • MD5 SHA1 SHA512 SSDEEP TLSH

        spo0lve.exe

        • Path C:\windows\SysWOW64\drivers\spo0lve.exe
        • Size 11.0MB
        • SHA256 6f4d6021d1593b4d3cf7c555566b12b48b34525f7832e4523d6843cbb67348ee
        • MD5 SHA1 SHA512 SSDEEP TLSH

        memory/2500-5-0x0000000000400000-0x00000000004E4000-memory.dmp

        memory/4980-0-0x0000000000400000-0x00000000004E4000-memory.dmp

        memory/4980-4-0x0000000000400000-0x00000000004E4000-memory.dmp