Overview

overview

8

Static

static

3

2026-05-16...ar.exe

windows10-2004-x64

8

2026-05-16...ar.exe

windows11-21h2-x64

8

Analysis

  • max time kernel
    149s
  • max time network
    149s
  • platform
    windows11-21h2_x64
  • resource
    win11-20260513-en
  • resource tags

    arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
  • submitted
    16/05/2026, 13:59

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-05-16_1f1ae155085e618dd3f1ae933b2f3593_cobalt-strike_elex_emotet_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe
  • Size 13.2MB
  • Sample260516-ractvaew7y
  • SHA256 63e9fe65385ee391e4e03a4312980248b65700b2d8af643fd0e8e90624bc6f02
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
defense_evasiondiscoverypersistenceransomware

Malware Config

Signatures

  • Drops file in Drivers directory 3 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Sets desktop wallpaper using registry 2 TTPs 2 IoCs
    ransomware
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies Control Panel 4 IoCs
    defense_evasion
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-05-16_1f1ae155085e618dd3f1ae933b2f3593_cobalt-strike_elex_emotet_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-05-16_1f1ae155085e618dd3f1ae933b2f3593_cobalt-strike_elex_emotet_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:3772
  • C:\Users\Admin\AppData\Local\Temp\2026-05-16_1f1ae155085e618dd3f1ae933b2f3593_cobalt-strike_elex_emotet_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe
    C:\Users\Admin\AppData\Local\Temp/2026-05-16_1f1ae155085e618dd3f1ae933b2f3593_cobalt-strike_elex_emotet_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:3348

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        7zG.exe
        • Path C:\Program Files\7-Zip\7zG.exe
        • Size 13.9MB
        • SHA256 40a90c14b0b5b4b25e390804b868681706f587e7e750682c68be29b045929138
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VSTOInstaller.exe
        • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
        • Size 26.5MB
        • SHA256 0795efb380b9ef9ec9c0d16fbcaa2bba47f83a2830b79753141e67ec808e2b1f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrmstp.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        • Size 32.5MB
        • SHA256 5513d3854c8a6ddf43232ec0911d4b87661c289c785bd48ad61605b46e5cd947
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_pwa_launcher.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 28.1MB
        • SHA256 fa529dc1d03574d69328c794426e599c26beb2f9e2ebc8b463b21b31443e3ab4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevated_tracing_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 29.9MB
        • SHA256 761bdea77125698f628744271adfedfbad81136491bc0b3310fb5981547bf81e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 28.7MB
        • SHA256 ee6870b22340b2bef16df7a16c0570d4f35a7adeadafd5ec9bbfce97e21cce97
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notification_helper.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 28.0MB
        • SHA256 5161299394d650886f04dd36abad146cfc2e45da48d2a4a996ca13187cde4492
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        os_update_handler.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 28.3MB
        • SHA256 152e2cd606953f454cf53d4ccd2feb889f7aa7aec0794a215e33a550f70e4fdd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_proxy.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 27.8MB
        • SHA256 a893ba7e273c6a3bf4f380436a4b14dbf4e879fa9c776cd60978d417f8337c50
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 26.4MB
        • SHA256 63398edd01206f5477e19e9571989a55aba5ab1541063f322c13fad8acc6e7a9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 26.4MB
        • SHA256 7175754673606011a5234bf6c24dd1a71efef3a1317072b31f44391a183a2cf1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 26.4MB
        • SHA256 221beba922ddef7989567c376264545c465a4970ddaf538dad4021fb28421852
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 26.5MB
        • SHA256 1753baec98f862f32938d23fd06cfbe759e2de546da6af87f507e62bfcb3d5cb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jar.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 26.4MB
        • SHA256 3b6aff7fa42b12990ac6686d9c7e21798d2c0b34f9397d4b00484ff547ab3b01
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jarsigner.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        • Size 26.4MB
        • SHA256 4d834fd9a589afa1a081bf4271b4bd9f4b542f56ce45d9c5d2588b340ae43458
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 26.4MB
        • SHA256 16aa59ff18785465e9a1386c0e275810eb1f4f23432187580a4fc12ae191e3e8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
        • Size 26.7MB
        • SHA256 452a74d528753686e6408c6c1c4cfb364a56892ddd03f0b2742342c135c7c26b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javac.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
        • Size 26.4MB
        • SHA256 e05e3be48565718ef5ee5f0e8fc63c944e7e08aac54d1bbf27de846206c8a43c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javadoc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
        • Size 26.4MB
        • SHA256 592f3e47cd0ef6b8af4169fedb5a18e6acc186b2d430c1408039163c9fb04e24
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javafxpackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
        • Size 26.6MB
        • SHA256 20528c1101c48aabf54c852699a3e09d05e953bbc1b3b3e0cef738b903599f9b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javah.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
        • Size 26.4MB
        • SHA256 6b70a97540fc91f8ae3d7c9c4283407774f7265a9fe9b3dfbdfabad091ecb8b0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
        • Size 26.4MB
        • SHA256 3a42e9ad4c846bd0eccac0d0f63537245badbee3f85767d70bdef6ee2c48e859
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javapackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
        • Size 26.6MB
        • SHA256 4195c979e69af622266c72a8d6a3587127673bc31931c1f75c9abbab57be5e0a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaw.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
        • Size 26.7MB
        • SHA256 3ce87750458f2871eb8b18d19465fdf179f9eaea7b6a57fb9e6a3293135f6602
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
        • Size 26.9MB
        • SHA256 7e796a2a485fd27497827fc9ef50769013b4ec876142f3c0b66c624b166eacfe
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jcmd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
        • Size 26.4MB
        • SHA256 d1407ea7f8ad41a668887fbbd2c1601f1671472539f2a2a3e31cbebd4ff338d4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jconsole.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
        • Size 26.4MB
        • SHA256 a929075634e4db6eaa943855f437ad70b628056dda7891aed1ae5a371635bab4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdb.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
        • Size 26.4MB
        • SHA256 28a8d6450cfba12d3acedf53ae62214afdead1ac18580865a097abecd0557a0e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdeps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
        • Size 26.4MB
        • SHA256 081ea1f150d479469126395aab23a104f7daf466d6efb7f5f17c33d34346fa8a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jhat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
        • Size 26.4MB
        • SHA256 8688aa3691726b9c877fbc31748585125de5451eabff4048e2bf128db6ffd13d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jinfo.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
        • Size 26.4MB
        • SHA256 2db4dee031c7082fd962900b27a8cefc475911ffa9f905782fdd8a15d0a7dad6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jjs.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
        • Size 26.4MB
        • SHA256 1b43abb267587f43549e05c7665861f8ef78c7bb75bb665e8d75fd14d2c1c341
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jmap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
        • Size 26.4MB
        • SHA256 0c702c7e95ed02de6e91f082a29276317091c49169c82e7ba89ab4521521672d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
        • Size 26.4MB
        • SHA256 3d57f4d9b79c1f3b614ae06efad227fd4e20cda293ce59588e994b15a9877f05
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jrunscript.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
        • Size 26.4MB
        • SHA256 428283cdf0205c75dbf2811a4196860a278a292398b5b5ddd3b45669e24a049b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jsadebugd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
        • Size 26.4MB
        • SHA256 ffe4e74ffb29dfce3753104ff0b64d7ff68f123a80b539c98789db17696f64bc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstack.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
        • Size 26.4MB
        • SHA256 30e4dc050ef82589d5d6d2e02e7358eb180b2b0a15e23f766c6ca544e409814e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
        • Size 26.4MB
        • SHA256 9fdac411ae7267121a5cdb198da1f23b6c200fd9051ab1b1e382d04acd1dac5e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstatd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
        • Size 26.4MB
        • SHA256 f1174d7a396ad7b8a672f521253e22b680c854c4092189f9b8fb750a75c5dcea
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        kinit.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
        • Size 26.4MB
        • SHA256 0bbcae5dc1722c204e2d7e9e55f74357b70b272658a24394ee36c0770ac4b8a5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        klist.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
        • Size 26.4MB
        • SHA256 dc87dab1722f4a677a062bbdfddb4affaa3218a6bf0889f663610dc06f292067
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ktab.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
        • Size 26.4MB
        • SHA256 df04b07e3282c283f222ddfa1d2bcd0e8bff97efc25d1f9e222ec44dc08d0408
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        native2ascii.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
        • Size 26.4MB
        • SHA256 6ef00c56b8e23ffacb19e331aede08b63f49426aa0fd81a1a4d3f1c01cd9fee4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        orbd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
        • Size 13.2MB
        • SHA256 a4cffb928006837aa873614afeebe0141ad6d7dea1124b57c342afd945c9273f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
        • Size 26.4MB
        • SHA256 ae6e4a45e7305984fa6fd318df5252061cbab2fc936875876bab809cd965e248
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        policytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
        • Size 26.4MB
        • SHA256 56c6c30db2cd52f2dd97d69cd75d96bcf72cb74c456e089aebe4aa3e99886641
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmic.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
        • Size 26.4MB
        • SHA256 94ac1feb89ebcda8cfe6ee91204ec8930ff3579aec47ed26fd52623b3985f300
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmid.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
        • Size 64KB
        • SHA256 79a0b1f3b0958e830806c9254c2ba2af079ac99713004febcc3610200c9f504e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmiregistry.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
        • Size 26.4MB
        • SHA256 daaa83ccbbd380e4e420376f68e334d6acca82237f695e7182155aa22dc9f075
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        schemagen.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
        • Size 26.4MB
        • SHA256 31619770d1d84cddd821d52bbd2485c9857b99124291953e9961533240c9dcd3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        serialver.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
        • Size 26.4MB
        • SHA256 5730106575e67d33c0608a6c5f44dc29f48f59a04ece0cd7e5c0d8171d1708c8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        wsgen.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
        • Size 26.4MB
        • SHA256 a71fd141e0a38097e6163347715f059aaa6313172756da5344a90b4e1c7c3d23
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        wsimport.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
        • Size 26.4MB
        • SHA256 de2d9f57e26d4dcce1b0afb56c67f3d62ca2f55975545e0d33943f4254e779ff
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        xjc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
        • Size 26.4MB
        • SHA256 03868ddb07c1ad1db4018dd0df3fe6f718edcadfbdc9f227bc6af9e176ad9900
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dotnet.exe
        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 26.6MB
        • SHA256 021a313fd7b029f43a2d95242a48111289fba1d9fee746c7c457cf12500242ba
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 26.5MB
        • SHA256 dd5f0d1dbc176aa3fe077d1aed6f7c3ffaecc5fdb54edf8a7fa964a12017d240
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 26.5MB
        • SHA256 5e3c9abe7978ddebe0fdc0939840230db4607f896f37bcbe25a8616de01d490b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        spo0lve.exe
        • Path C:\windows\SysWOW64\drivers\spo0lve.exe
        • Size 13.2MB
        • SHA256 63e9fe65385ee391e4e03a4312980248b65700b2d8af643fd0e8e90624bc6f02
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download