Overview

overview

8

Static

static

3

2026-08-20...ar.exe

windows10-2004-x64

8

2026-08-20...ar.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    105s
  • max time network
    104s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260513-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    20/08/2026, 05:40

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-20_930a1372fdbc0d317f52a3c308a40a4b_cobalt-strike_elex_emotet_glassworm_icedid_njrat_remcos_vidar.exe
  • Size 36.5MB
  • Sample260820-gdatjser7w
  • SHA256 cc174f0c9b1c605dc09e8c2e054b510db72edd469496ade04e333acd05c42fed
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
discoverypersistence

Malware Config

Signatures

  • Drops file in Drivers directory 3 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-20_930a1372fdbc0d317f52a3c308a40a4b_cobalt-strike_elex_emotet_glassworm_icedid_njrat_remcos_vidar.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-20_930a1372fdbc0d317f52a3c308a40a4b_cobalt-strike_elex_emotet_glassworm_icedid_njrat_remcos_vidar.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:4444
  • C:\Users\Admin\AppData\Local\Temp\2026-08-20_930a1372fdbc0d317f52a3c308a40a4b_cobalt-strike_elex_emotet_glassworm_icedid_njrat_remcos_vidar.exe
    C:\Users\Admin\AppData\Local\Temp/2026-08-20_930a1372fdbc0d317f52a3c308a40a4b_cobalt-strike_elex_emotet_glassworm_icedid_njrat_remcos_vidar.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:4260

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        7zG.exe
        • Path C:\Program Files\7-Zip\7zG.exe
        • Size 37.2MB
        • SHA256 f50feb0d96abfd7658c74b431beb863179a789b18a198e21adb2d9deb40897b6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javah.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
        • Size 73.0MB
        • SHA256 5126f2a30b9592e09ef81a4f9cdc68fc3774d2bd74ea7329bfda824db44ee21a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
        • Size 73.0MB
        • SHA256 f18980b12b38ca442a2e87c737f69465d3a42c322b9b204bdf4374286270c8b0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javapackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
        • Size 73.2MB
        • SHA256 dfeb2ead463d7dd1e47e6491e8ee31c62d4a9997c418c762c6a3a5097dc236ba
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaw.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
        • Size 73.3MB
        • SHA256 3b979a0daa33fd67b17c3cf355632b0ed48140ff5ec0bb0280f79979f6e6813b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
        • Size 73.5MB
        • SHA256 4645664277fd7d360e0fd5163ec420af7f7a19ae54d427e03a9bb2895e86016a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jcmd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
        • Size 73.0MB
        • SHA256 bad676069fcdc58a19f759cf35c8c83652123deff9aa70c96935db266e37d688
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdb.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
        • Size 73.0MB
        • SHA256 c9cb42cd9b10f3b721c44218f49a8734d6da7c986e0239bdbcee272016422403
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jinfo.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
        • Size 73.0MB
        • SHA256 35ff41beee1e5bc4718555819f9897394544e962e78b4a64375a50a671ba501c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jjs.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
        • Size 73.0MB
        • SHA256 12b75c2273e7c98aeab44c9e89cc804832850cf6f891e1ec2620b3397bc93e09
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jmap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
        • Size 73.0MB
        • SHA256 bf2dc835cddaed5c670fa72b860ecc116550255460cc78c38ae8fb7e3c55d132
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
        • Size 73.0MB
        • SHA256 42ac2596b12d4a14a4995e797005adb6e8d23530f9ff6a8be408acbc2d501fe0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstatd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
        • Size 73.0MB
        • SHA256 9e1153bf9949edcca1ee56f20b4c7fde989806220e26ba11491f1409d6487b39
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmiregistry.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
        • Size 73.0MB
        • SHA256 511d20a892d9975dd3bf1579fe919dd7e796edca2e242937bda39829e70a34e5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        schemagen.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
        • Size 73.0MB
        • SHA256 9232791c4a9bab01c3538b835856c2eb65685e081de9be2002368d898e8d8b08
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        tnameserv.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
        • Size 72.6MB
        • SHA256 e3148c6bbc4ba56243d026da043e648634dfcb44f63281205b66645a4e6caa84
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        unpack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\unpack200.exe
        • Size 47.8MB
        • SHA256 a85df7a48c2501a07bd78010b60be5e0574b43c414f99ed61c3910fc3e0fe9fd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        wsgen.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
        • Size 48.4MB
        • SHA256 4cd937fad7fa59acf39ba31fd7438aef00bff718c0713616d4cfeaec9741c2bc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        wsimport.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
        • Size 46.6MB
        • SHA256 7c8475161e050f9b52a9418c7cd589042b023815d46dba5cf8f346de81289b45
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        xjc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
        • Size 46.4MB
        • SHA256 56a181155675952a094d6db95b2fe2a4027ef34d51bc69b550b2597a1921eee0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe
        • Size 48.2MB
        • SHA256 0485d9c295064a541cf58854681f9c7dfb76e2c88ba6cb356acbc58f51d306dc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe
        • Size 46.1MB
        • SHA256 e93424210c20202a72d90def20ea97ec2fdcbb1a09e74bf92921e6b201d1ff07
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javacpl.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe
        • Size 44.6MB
        • SHA256 9b64774eed9dc6d46f0a192c645b868b35c156c5210130907ba2791ed3ac3637
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaw.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe
        • Size 43.2MB
        • SHA256 0fae1310afc38d80fcabce95c80a24bbae91fa0f239f5a0d38a35c6126413378
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe
        • Size 45.3MB
        • SHA256 ae3968cdb2775e130cdf1418feaf388f9367268356904154afdcc10b7d9ac4b3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jjs.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe
        • Size 42.0MB
        • SHA256 140827876cef70420f4cae99d8043aadf3021bf4116d3932d82baf634efe0817
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jp2launcher.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe
        • Size 41.1MB
        • SHA256 1ee487a73b8d127afcc04d1ceed4113fd98fd3f319a97d526b51640d175bc3dd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        keytool.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe
        • Size 39.2MB
        • SHA256 76d384be484a9970bf1ba95382bbfb8328527f9458c15689a8fbee3f26139920
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        kinit.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe
        • Size 37.7MB
        • SHA256 708e11aebda78e5f38ce5b72f1e95689b405e17c58431b73a965301b5401a410
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        klist.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe
        • Size 36.4MB
        • SHA256 1ff69b4526fdb59276d117d1456ad42e6e5586b462b8d18f28a8f1a48a4925a3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        orbd.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe
        • Size 34.7MB
        • SHA256 c291052ce335c534cecaae7dc95b6f6beff5a995056511e74f1bd31d35152813
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pack200.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe
        • Size 33.7MB
        • SHA256 e8a8c267be0f7159f84378d0c98009824c38eb57c167c710b5dc0d61013c8bc9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        policytool.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe
        • Size 32.3MB
        • SHA256 feea417121dfce260f8e345cfa41c1f81222ff4fe9d35470b694c3dee6d1b76b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmid.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe
        • Size 31.8MB
        • SHA256 005865fe8184d3316a9fa723eae66f1c4f316eb2745f06676b51709b8f993a02
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmiregistry.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe
        • Size 31.5MB
        • SHA256 f873a5512bbc7848a0db8e65db0a862413c7ac94ca6d5fc8cdd0e37afd2756ff
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ssvagent.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe
        • Size 31.2MB
        • SHA256 865bed24ae6372c3c7072081aad200a4fcf6dac75dd0f0b1fdc995f9b7d0f94e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        spo0lve.exe
        • Path C:\windows\SysWOW64\drivers\spo0lve.exe
        • Size 36.5MB
        • SHA256 cc174f0c9b1c605dc09e8c2e054b510db72edd469496ade04e333acd05c42fed
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download