Overview

overview

8

Static

static

3

2026-08-20...ar.exe

windows10-2004-x64

8

2026-08-20...ar.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    44s
  • max time network
    114s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    20/08/2026, 05:40

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-20_930a1372fdbc0d317f52a3c308a40a4b_cobalt-strike_elex_emotet_glassworm_icedid_njrat_remcos_vidar.exe
  • Size 36.5MB
  • Sample260820-gdatjser7w
  • SHA256 cc174f0c9b1c605dc09e8c2e054b510db72edd469496ade04e333acd05c42fed
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
discoverypersistence

Malware Config

Signatures

  • Drops file in Drivers directory 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-20_930a1372fdbc0d317f52a3c308a40a4b_cobalt-strike_elex_emotet_glassworm_icedid_njrat_remcos_vidar.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-20_930a1372fdbc0d317f52a3c308a40a4b_cobalt-strike_elex_emotet_glassworm_icedid_njrat_remcos_vidar.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:3452
  • C:\Users\Admin\AppData\Local\Temp\2026-08-20_930a1372fdbc0d317f52a3c308a40a4b_cobalt-strike_elex_emotet_glassworm_icedid_njrat_remcos_vidar.exe
    C:\Users\Admin\AppData\Local\Temp/2026-08-20_930a1372fdbc0d317f52a3c308a40a4b_cobalt-strike_elex_emotet_glassworm_icedid_njrat_remcos_vidar.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:852

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        AppVShNotify.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
        • Size 36.8MB
        • SHA256 96c718dec4e76b938f66e3071f33c9a44ae17dcde7c43e8e79207e1e37744951
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        InspectorOfficeGadget.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
        • Size 73.1MB
        • SHA256 0927c1fa474c76b6b5d8adb1c02a6836ae08083b754936e92f40b0d547f28253
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        IntegratedOffice.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
        • Size 77.1MB
        • SHA256 18b28f96861546d08cd6e30c8a26e214c842015cee3cb23a0bcd6d75d86fd7ec
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MavInject32.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
        • Size 73.4MB
        • SHA256 f8b912aa802e7677d168fe7a57ac8d31d0064840cdce8c6ca0888ef2a1036a26
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appvcleaner.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
        • Size 38.6MB
        • SHA256 64b8193c45a9314f18b6ede9d5d31da08693264c37ce83ce3bf2e152403a532a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VSTOInstaller.exe
        • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
        • Size 73.1MB
        • SHA256 89763b2c67e115154370cf006071ed9c4b02f772a4601f20f60b67bef7cfac5d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ExitResolve.asp
        • Path C:\Program Files\ExitResolve.asp
        • Size 72.6MB
        • SHA256 aabd45ad78da6cfc81fc68f38bab71d38896419ba64fa75143d368b2b9183b4e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrmstp.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        • Size 69.2MB
        • SHA256 a1e0f0ff1055301132e53b1a77da37ee186592da3ec1bd7172f249e16e694f93
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        setup.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
        • Size 66.1MB
        • SHA256 ca906b24bfb9f320ad75970cd8233539f2579e54706667f941fdbe22c8329b36
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_pwa_launcher.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 70.6MB
        • SHA256 f331fdae20642ee1cd8440d085e4fd7c4237ddbf2cf89937ba0107d7cf5dfc00
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevated_tracing_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 70.6MB
        • SHA256 bfeda08b4c063eb6ff8fb3b3996dff76338de9a05abd3523f5f7dacbd1030a19
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 69.1MB
        • SHA256 774358413801b68b4b66ae2f60e20fd3d08376be3ec589248a6d5e12073d7b08
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notification_helper.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 65.0MB
        • SHA256 37493b42221e546e8bbe4dbb6c7c6682e07f85ee7b1586725a1496324d3f4c37
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_proxy.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 63.4MB
        • SHA256 689969cbfdfce67ef88deacb21d41558fb492076d5526ca1b41f20484d66817b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 61.4MB
        • SHA256 bb53825a8fba15089c8acd6f7aef305966e15182d9b5f4b61be2934ff45f1e9a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 61.5MB
        • SHA256 507517141d6677d51435fe7f0d11bf9fe71c6c6c8541d59f82ae5310c86db673
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jar.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 60.8MB
        • SHA256 13e6d74ead985703b5b30fc13aa1717c45bc5887f08b4e849f72991edacb428f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 59.8MB
        • SHA256 74ca20e5129fa73c348d0cbb2ca5bf545d60ab6edefecf483e5a75c8859a4be6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javac.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
        • Size 59.1MB
        • SHA256 b466c90efe6a9a0ca8378b3f4337335be20e365abd8da1cd5c16f3654e80020c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
        • Size 55.0MB
        • SHA256 be49cf5a98e2243a2c8684d44f090450d45c2f49c5df9940e8428cb32009ca73
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaw.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
        • Size 54.6MB
        • SHA256 dc7efa88b0719dc3a57ad5615709ea1a71fc931ea0ed0241519b82e2a1eac443
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jconsole.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
        • Size 53.1MB
        • SHA256 59aab4ade1fa80654958a9467909d8ad417c1b64d94bd31dab1586aff32f8f86
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdeps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
        • Size 52.2MB
        • SHA256 776f7dcd0edb8c672f0a79696f024552c4a65565ab4e143f4c5fd7b4cd5fb3f7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jhat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
        • Size 384KB
        • SHA256 3e4e65210d0ce663e458df3dc7915e7345a65463edc2c4781b0feb1a0cd3389a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jinfo.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
        • Size 51.4MB
        • SHA256 967c7e5000a7d958d4f1acef771b266cb15a50d6d0220ee9f561e803d7e0a33a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jmap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
        • Size 47.4MB
        • SHA256 93f35bf9b216859b9e6febf32941c12d48a3db74d0c1dd1cf21c4c2a6d8dcfc8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
        • Size 46.0MB
        • SHA256 73a136d6a11ac1cc3575492f4931818e1021481096d7a6a10853a1fa7564660b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jrunscript.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
        • Size 45.5MB
        • SHA256 31c16308cc026677a32035f0b22118e8df8ea4c629b87a7627d1552403de1082
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jsadebugd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
        • Size 44.1MB
        • SHA256 6a9119f44d17240ef9dca67fac0b61c77106f5e15816b6300df9771e4d755589
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstack.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
        • Size 43.3MB
        • SHA256 4395329bffe792379906b0ed8ecbeb62feef8c49b95a2becab7dcd0f0e08286c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
        • Size 43.1MB
        • SHA256 12cb32853568bbe55040cf7bc5360777385ddf126c7c02f6d7fd957bfe5b704d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstatd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
        • Size 42.9MB
        • SHA256 770cd985d678dc672dca83e29994dbb3cf2792cecfe1532c0e6c97e1575188db
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        keytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
        • Size 42.2MB
        • SHA256 d6fe9b547b14531404b12b574e54cd3c5ac8e3051222f1300a0950ba24be4a72
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ktab.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
        • Size 64KB
        • SHA256 79a0b1f3b0958e830806c9254c2ba2af079ac99713004febcc3610200c9f504e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dotnet.exe
        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 73.2MB
        • SHA256 b88fa049f180abe72d83187f17011f73f6e9de70717c8f89180647a6a4f53917
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 73.1MB
        • SHA256 a0bfd65d00c49e797ca447280fc92ffdb93184024d37003712399405d26d0270
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 73.1MB
        • SHA256 b067c575dfb6934837fccf6332ccd1805563b634b0e0a157e3e9d7afec252467
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 36.6MB
        • SHA256 c80c59fc9724f89615e004a77abb4f17d58c3e789985a0aa5883f4628e644248
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download