Overview

overview

8

Static

static

3

2026-05-16...ar.exe

windows10-2004-x64

8

2026-05-16...ar.exe

windows11-21h2-x64

8

Analysis

  • max time kernel
    149s
  • max time network
    153s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260513-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    16/05/2026, 13:59

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-05-16_1f1ae155085e618dd3f1ae933b2f3593_cobalt-strike_elex_emotet_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe
  • Size 13.2MB
  • Sample260516-ractvaew7y
  • SHA256 63e9fe65385ee391e4e03a4312980248b65700b2d8af643fd0e8e90624bc6f02
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
defense_evasiondiscoverypersistenceransomware

Malware Config

Signatures

  • Drops file in Drivers directory 3 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Sets desktop wallpaper using registry 2 TTPs 2 IoCs
    ransomware
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies Control Panel 4 IoCs
    defense_evasion
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-05-16_1f1ae155085e618dd3f1ae933b2f3593_cobalt-strike_elex_emotet_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-05-16_1f1ae155085e618dd3f1ae933b2f3593_cobalt-strike_elex_emotet_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:4844
  • C:\Users\Admin\AppData\Local\Temp\2026-05-16_1f1ae155085e618dd3f1ae933b2f3593_cobalt-strike_elex_emotet_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe
    C:\Users\Admin\AppData\Local\Temp/2026-05-16_1f1ae155085e618dd3f1ae933b2f3593_cobalt-strike_elex_emotet_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:3420

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        7zG.exe
        • Path C:\Program Files\7-Zip\7zG.exe
        • Size 13.9MB
        • SHA256 40a90c14b0b5b4b25e390804b868681706f587e7e750682c68be29b045929138
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        AppVShNotify.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
        • Size 13.5MB
        • SHA256 95b5214e3e5de3e96a929efcface901a09b0c5a912fb5fd806323f603c330ae0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 16.3MB
        • SHA256 e0838ffc2e1576a7e5d12b839b5e35e9d0cb55b055c910bd9a62b18284cb6eb1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_proxy.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 27.8MB
        • SHA256 a893ba7e273c6a3bf4f380436a4b14dbf4e879fa9c776cd60978d417f8337c50
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 26.4MB
        • SHA256 63398edd01206f5477e19e9571989a55aba5ab1541063f322c13fad8acc6e7a9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 26.4MB
        • SHA256 7175754673606011a5234bf6c24dd1a71efef3a1317072b31f44391a183a2cf1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 26.4MB
        • SHA256 221beba922ddef7989567c376264545c465a4970ddaf538dad4021fb28421852
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 26.5MB
        • SHA256 1753baec98f862f32938d23fd06cfbe759e2de546da6af87f507e62bfcb3d5cb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jar.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 26.4MB
        • SHA256 3b6aff7fa42b12990ac6686d9c7e21798d2c0b34f9397d4b00484ff547ab3b01
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jarsigner.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        • Size 26.4MB
        • SHA256 4d834fd9a589afa1a081bf4271b4bd9f4b542f56ce45d9c5d2588b340ae43458
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 26.4MB
        • SHA256 16aa59ff18785465e9a1386c0e275810eb1f4f23432187580a4fc12ae191e3e8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
        • Size 26.7MB
        • SHA256 452a74d528753686e6408c6c1c4cfb364a56892ddd03f0b2742342c135c7c26b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javac.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
        • Size 26.4MB
        • SHA256 e05e3be48565718ef5ee5f0e8fc63c944e7e08aac54d1bbf27de846206c8a43c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javadoc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
        • Size 26.4MB
        • SHA256 592f3e47cd0ef6b8af4169fedb5a18e6acc186b2d430c1408039163c9fb04e24
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javah.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
        • Size 26.4MB
        • SHA256 6b70a97540fc91f8ae3d7c9c4283407774f7265a9fe9b3dfbdfabad091ecb8b0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
        • Size 26.4MB
        • SHA256 3a42e9ad4c846bd0eccac0d0f63537245badbee3f85767d70bdef6ee2c48e859
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javapackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
        • Size 26.6MB
        • SHA256 4195c979e69af622266c72a8d6a3587127673bc31931c1f75c9abbab57be5e0a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaw.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
        • Size 26.7MB
        • SHA256 3ce87750458f2871eb8b18d19465fdf179f9eaea7b6a57fb9e6a3293135f6602
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
        • Size 26.9MB
        • SHA256 7e796a2a485fd27497827fc9ef50769013b4ec876142f3c0b66c624b166eacfe
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jcmd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
        • Size 26.4MB
        • SHA256 d1407ea7f8ad41a668887fbbd2c1601f1671472539f2a2a3e31cbebd4ff338d4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jconsole.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
        • Size 26.4MB
        • SHA256 a929075634e4db6eaa943855f437ad70b628056dda7891aed1ae5a371635bab4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdb.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
        • Size 26.4MB
        • SHA256 28a8d6450cfba12d3acedf53ae62214afdead1ac18580865a097abecd0557a0e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdeps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
        • Size 26.4MB
        • SHA256 081ea1f150d479469126395aab23a104f7daf466d6efb7f5f17c33d34346fa8a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jhat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
        • Size 26.4MB
        • SHA256 8688aa3691726b9c877fbc31748585125de5451eabff4048e2bf128db6ffd13d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jinfo.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
        • Size 26.4MB
        • SHA256 2db4dee031c7082fd962900b27a8cefc475911ffa9f905782fdd8a15d0a7dad6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jjs.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
        • Size 26.4MB
        • SHA256 1b43abb267587f43549e05c7665861f8ef78c7bb75bb665e8d75fd14d2c1c341
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jmap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
        • Size 26.4MB
        • SHA256 0c702c7e95ed02de6e91f082a29276317091c49169c82e7ba89ab4521521672d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
        • Size 26.4MB
        • SHA256 3d57f4d9b79c1f3b614ae06efad227fd4e20cda293ce59588e994b15a9877f05
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jrunscript.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
        • Size 26.4MB
        • SHA256 428283cdf0205c75dbf2811a4196860a278a292398b5b5ddd3b45669e24a049b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jsadebugd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
        • Size 26.4MB
        • SHA256 ffe4e74ffb29dfce3753104ff0b64d7ff68f123a80b539c98789db17696f64bc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstack.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
        • Size 26.4MB
        • SHA256 30e4dc050ef82589d5d6d2e02e7358eb180b2b0a15e23f766c6ca544e409814e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
        • Size 26.4MB
        • SHA256 9fdac411ae7267121a5cdb198da1f23b6c200fd9051ab1b1e382d04acd1dac5e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstatd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
        • Size 26.4MB
        • SHA256 f1174d7a396ad7b8a672f521253e22b680c854c4092189f9b8fb750a75c5dcea
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        keytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
        • Size 26.4MB
        • SHA256 314530cfb0dd69869bceae9a56cff19aab02b5baad7dd17670bceb9f775151e0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        kinit.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
        • Size 26.4MB
        • SHA256 0bbcae5dc1722c204e2d7e9e55f74357b70b272658a24394ee36c0770ac4b8a5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        klist.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
        • Size 26.4MB
        • SHA256 dc87dab1722f4a677a062bbdfddb4affaa3218a6bf0889f663610dc06f292067
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ktab.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
        • Size 13.2MB
        • SHA256 810ec5d6b2d5268eb49d2afcf91bd24545dd65149ae00a03fc4e3ca939d896d2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        native2ascii.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
        • Size 26.4MB
        • SHA256 6ef00c56b8e23ffacb19e331aede08b63f49426aa0fd81a1a4d3f1c01cd9fee4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        orbd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
        • Size 26.4MB
        • SHA256 6e7083afe5f1ab37b4bdebf474b3ddd282daffab992945029a5662127f13085f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
        • Size 26.4MB
        • SHA256 ae6e4a45e7305984fa6fd318df5252061cbab2fc936875876bab809cd965e248
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        policytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
        • Size 26.4MB
        • SHA256 56c6c30db2cd52f2dd97d69cd75d96bcf72cb74c456e089aebe4aa3e99886641
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmic.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
        • Size 26.4MB
        • SHA256 94ac1feb89ebcda8cfe6ee91204ec8930ff3579aec47ed26fd52623b3985f300
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmid.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
        • Size 26.4MB
        • SHA256 997a41a9524d914743f9d8c4fba2726aa3d4eda497daf9225dfa8e4077db27c8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmiregistry.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
        • Size 26.4MB
        • SHA256 daaa83ccbbd380e4e420376f68e334d6acca82237f695e7182155aa22dc9f075
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        schemagen.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
        • Size 26.4MB
        • SHA256 31619770d1d84cddd821d52bbd2485c9857b99124291953e9961533240c9dcd3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        serialver.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
        • Size 26.4MB
        • SHA256 5730106575e67d33c0608a6c5f44dc29f48f59a04ece0cd7e5c0d8171d1708c8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        servertool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
        • Size 26.4MB
        • SHA256 6ea4c2b8fa84817ff48adb77f6aa8eab76ffbe9ea3837d6575aca138a227813d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        tnameserv.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
        • Size 26.4MB
        • SHA256 62682d4d683fe4955cfc00d1fd0cdd7a1e5370f2de8295c5608fbd55d525b96e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        unpack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\unpack200.exe
        • Size 26.6MB
        • SHA256 accde29df0300f1d888e316743c0851e2b43dbad866e149fbad919a26e4203f6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        wsgen.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
        • Size 26.4MB
        • SHA256 a71fd141e0a38097e6163347715f059aaa6313172756da5344a90b4e1c7c3d23
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        wsimport.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
        • Size 26.4MB
        • SHA256 de2d9f57e26d4dcce1b0afb56c67f3d62ca2f55975545e0d33943f4254e779ff
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        xjc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
        • Size 26.4MB
        • SHA256 03868ddb07c1ad1db4018dd0df3fe6f718edcadfbdc9f227bc6af9e176ad9900
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe
        • Size 26.5MB
        • SHA256 15fe073b2405d4eb533cb630f3b2193a806b7b36ededc8535f0fdc92f4e454b5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe
        • Size 26.4MB
        • SHA256 e4735c3add1d0d6f5f91b7121819708b7788edd9c82a64ae5d726aa76e91a2fa
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\java.exe
        • Size 26.7MB
        • SHA256 5ad95cc812a2299f1143f1653ea99f4fccb62a0620b9af331ef687668ffb71d6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javacpl.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe
        • Size 26.5MB
        • SHA256 b4813b2e3269b43ec55f94a3f7add03eeaad741090aef52a08b38d2ac0074279
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaw.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe
        • Size 26.7MB
        • SHA256 50026b9b0d822e59a79dcd0713a9013b30a7d341f86dafd31ecc5f8ff8a6012d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe
        • Size 26.9MB
        • SHA256 7b679629f243c105bccaf7047d4bac0ca48c5c6ee6297604573e567fb47b6d8c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jjs.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe
        • Size 26.4MB
        • SHA256 efca7ff999c2f062cecb75078f1aa5aeab3ddf474ae0663176d53aff83f5cc36
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jp2launcher.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe
        • Size 26.6MB
        • SHA256 a17a251bc3e233da6f60cfd04d943669adbf71bf937b3bb3f1f89b74d5dd783b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        keytool.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe
        • Size 26.4MB
        • SHA256 0d1a8f4f69dbe38ec63cdfc12b2277d03d453e5e6ed71048a5aadb80f9257ff2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        kinit.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe
        • Size 26.4MB
        • SHA256 2040dbd0d8934a8a8b0798a91ea47ffc04e5a831ab57b6297211fd4569bfecb8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        spo0lve.exe
        • Path C:\windows\SysWOW64\drivers\spo0lve.exe
        • Size 13.2MB
        • SHA256 63e9fe65385ee391e4e03a4312980248b65700b2d8af643fd0e8e90624bc6f02
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download