Overview

overview

8

Static

static

3

2026-05-23...ar.exe

windows10-2004-x64

8

2026-05-23...ar.exe

windows11-21h2-x64

8

Analysis

  • max time kernel
    145s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260513-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    23/05/2026, 15:13

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-05-23_c52e7702fbdaf02e181487f1c0622e18_cobalt-strike_elex_emotet_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe
  • Size 11.3MB
  • Sample260523-slps8aes5y
  • SHA256 b74f6dc939558a6a409af9e989ced3b44da56a4ad07a718123f0dfb6fe1217a8
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
defense_evasiondiscoverypersistenceransomware

Malware Config

Signatures

  • Drops file in Drivers directory 3 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Sets desktop wallpaper using registry 2 TTPs 2 IoCs
    ransomware
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies Control Panel 4 IoCs
    defense_evasion
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-05-23_c52e7702fbdaf02e181487f1c0622e18_cobalt-strike_elex_emotet_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-05-23_c52e7702fbdaf02e181487f1c0622e18_cobalt-strike_elex_emotet_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:2532
  • C:\Users\Admin\AppData\Local\Temp\2026-05-23_c52e7702fbdaf02e181487f1c0622e18_cobalt-strike_elex_emotet_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe
    C:\Users\Admin\AppData\Local\Temp/2026-05-23_c52e7702fbdaf02e181487f1c0622e18_cobalt-strike_elex_emotet_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:4580

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        7zG.exe
        • Path C:\Program Files\7-Zip\7zG.exe
        • Size 12.0MB
        • SHA256 090b50c262d4910fd667adf22214c4132dbae68398e8b0db9a7212db83b816f3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        IntegratedOffice.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
        • Size 26.7MB
        • SHA256 4af006aaf0cee262e8d2c57d99d0c5e64147f246891f56ebcbbfb2d083e7a96a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MavInject32.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
        • Size 23.0MB
        • SHA256 892fc33cab4d31101b122f73fe61c617da645cfdf8856bafabeaf9f518a03543
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        OfficeC2RClient.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
        • Size 46.1MB
        • SHA256 d0fcdd0cf06e69736a05554951caf2fa9a3f4728c4c056bd9101ad846e9bc4c5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appvcleaner.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
        • Size 24.8MB
        • SHA256 d3569e7211e9218132ffb6d9410ca2b37a5cd3f08505a82d0bb712b698fe2183
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VSTOInstaller.exe
        • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
        • Size 22.7MB
        • SHA256 549aa27abd92cd66107f1acf4c070d8ecb38ccaed32eb5a48398f74ed45ee8f7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrmstp.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        • Size 28.7MB
        • SHA256 2a0e5e6f12b8706c9508c33dc788f13cc78d714049773ccc068b982e83586d04
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_pwa_launcher.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 24.4MB
        • SHA256 d834a76149d0f9d7ad7ea3b947b4d7238a809e9d18ef78e793ffac3a4cbbb1f1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevated_tracing_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 26.1MB
        • SHA256 ba686a4932b5ac2e1f202939a3fccf223353ec647fa75de7d5699d7ca81d4561
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notification_helper.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 24.3MB
        • SHA256 d8951e77a355c0fcb6f246d362b64da2fc26eea3ee4200724978529a25d80ea3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        os_update_handler.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 24.5MB
        • SHA256 347c8c73fca47f780d8c9c0456a516dbf3f0dcb313c6262651a59f148cc2352b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 25.7MB
        • SHA256 7ff4b7c0feaf43ff7dcdcbbf7b45afa4df94e25fcbc57f4d6322013b1910ab1d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 22.7MB
        • SHA256 aeba8d7b2ff8d38b5e319501f41c4c92432c89e34f0af8a59b41e713151cbf6f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 22.7MB
        • SHA256 97873195d37c50d39a03992522978ac1ee6a441d4a4b903adb4524d410cf881c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 22.7MB
        • SHA256 7a92f84a8ec7b489a28885f99dcd128f5740358e28a21a3f292cb24c557ba910
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 22.7MB
        • SHA256 4373c3bd682d823bec90abe20dd702e54ee12eaade2c8f6d0d7005a367308570
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jar.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 22.7MB
        • SHA256 6a5ff1ca7ea880e1af569588f1c3afc8abd7ab22c88080cfd2268ade47809db8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jarsigner.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        • Size 22.7MB
        • SHA256 29c484a9a7702e02e884974c77b71cfb5d16516166ef2b7f0c8af5b23ad389fc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 22.7MB
        • SHA256 52c0c416b45bc11b921eb70cc0aa40819d4373100982a8f5676d0a95ed0cce16
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javac.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
        • Size 22.7MB
        • SHA256 ea7d2ad7f503303893ad8ad89ba7dcd79f1082afad126060dc8daabc8a04a7e7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javafxpackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
        • Size 22.8MB
        • SHA256 2f1e22b672e15cf8f25e8978601dc679d366321e7085a1b9058e8d538bf91a1f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
        • Size 22.7MB
        • SHA256 2e08eb793a7a83cf1ec6d9946c044045c6940736647d8575a725d150adf2e11e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javapackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
        • Size 22.8MB
        • SHA256 7aa53335cbd8cd842c64a1ccaf948ba6189bca4d3fe4fc438bdbb3833f6b36fd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaw.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
        • Size 22.9MB
        • SHA256 4a907c4fe2ba9999e9e54de8ef8963b1bc6324957af2dd1de2ed6a3fcc03578e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
        • Size 23.1MB
        • SHA256 f325c0688e5f5f727c7dd33790e9ba8c3e19380067c7dee7991c7db10b399b7b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jcmd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
        • Size 22.7MB
        • SHA256 cbe899d03a7d8294dcbb5ad6c5b93be05f8661482ce146ffa2369c2acff70aad
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jconsole.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
        • Size 22.7MB
        • SHA256 bec6aca8a9965a913119ae128634d3a6c4e2c6ef27debd00122b6346c8a9e3de
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdb.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
        • Size 22.7MB
        • SHA256 5f34ff4d2b416d78a9e0bba8c643cf08d208c84c43c176edf2706405425ea7e6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdeps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
        • Size 22.7MB
        • SHA256 b0a800038bfb3fd2c12490e67f7f7fe6bd0a15af67340bbacf8e3b4bf058df0e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jhat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
        • Size 22.7MB
        • SHA256 03ae6b20bbb2226ecd51a5f3eab8ecb69eca0fe24c25d71c3333849b8a3c6193
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jinfo.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
        • Size 22.7MB
        • SHA256 c7546c27a97b2f5524dd958796ae9770882e40ff307738c99e1466e355051f6a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jjs.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
        • Size 22.7MB
        • SHA256 41fc81fcceadd6ecbe579c329ff586adf1801c085c7cf978c1defb8451e391ba
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jmap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
        • Size 22.7MB
        • SHA256 f1e6f8427b45eede4d78a716b5ff79a1ab23632b96da7735e917c600eb5dea67
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
        • Size 22.7MB
        • SHA256 b52dfd093a1938e13590e6a84d37d3c962402c9505a6091dada06ddc16813bc8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jrunscript.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
        • Size 22.7MB
        • SHA256 0611fe5916e94ed0dd96284a2b08349eb3c8cd33e9481c5d4cf44c368dfc7b02
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jsadebugd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
        • Size 22.7MB
        • SHA256 fdcd8c5c2b86e03261e3a777bdc6ad5755a6f054253dcb6c328ab678d46bff43
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstack.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
        • Size 22.7MB
        • SHA256 9ed123837ad4d7695e64e51959edee75affbaa0436ea0690da9b4c6bacba1f0b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
        • Size 22.7MB
        • SHA256 be1ef555c2a6773943e30cb1a8f6f58f5d029d9c00ca961a22a9d7db83014e41
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstatd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
        • Size 22.7MB
        • SHA256 d4e74b51a6dacce923988952764d1de39be19709f02e6fc9680fe4455f8c39a4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        keytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
        • Size 22.7MB
        • SHA256 7fbb9326e85e56da73f3030a8e19f08633915ea75eaedbebea413ad108220f9a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        kinit.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
        • Size 22.7MB
        • SHA256 5a8a939f19c80ba0adb91cafe6693dba0650cca0db85ca9d64081e4b7a6ab0a4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        klist.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
        • Size 22.7MB
        • SHA256 730fd5ba0b8f86c2b657ed03ffe4c44c70ef61b802b2175082f4feb62c747481
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ktab.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
        • Size 22.7MB
        • SHA256 52a509995a808b34b70d4674cadd9fb9d92e68070ede158327c3f56a00684253
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        native2ascii.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
        • Size 22.7MB
        • SHA256 bc739dbc1ca1f31a1db028038e837ec63bc8c3d7406f203a799f95c39fc34045
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        orbd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
        • Size 22.7MB
        • SHA256 a511f0a0cd65735ac5674e6ca8822803b0bed9cbc605cd0ed278998d0400db6d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
        • Size 22.7MB
        • SHA256 b508a17724eb16c3fd123fd8081f851ba76e1446fab6d04bae4c736e80fa0a19
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        policytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
        • Size 22.7MB
        • SHA256 71a1f0c7b6ec9638b34cbbd9d339ec9ad24d05cca7e2df77558dcdb356af0362
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmic.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
        • Size 22.7MB
        • SHA256 20744bd9a79c144c789d6201054032e6d7a2f3b96445fab629b77d47d8a7e6f1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmid.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
        • Size 11.3MB
        • SHA256 7d6f3f4672659bea7654c1eeb6237e9a0a96b624f13a3c1a8dddc790036b1de6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmiregistry.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
        • Size 22.7MB
        • SHA256 9dd33668f51d829a566bd40e9b6784b49205fa0ed6f6a096054d4135fdfd1e17
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        schemagen.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
        • Size 22.7MB
        • SHA256 6e4a0b6276be52c8a5ecadf0c81d44b07aabe5244f3bcd2111eea47683c90808
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dotnet.exe
        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 22.8MB
        • SHA256 552719dfe15d342cd7b0493a848c64b73776c0a10856321276dc865f1060de28
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 22.7MB
        • SHA256 01936f4035c53fe8fc0649aab190309a2c7bf408baecd7f430546df4d370581d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 22.7MB
        • SHA256 8f68e84414810ebe3ee3a9cfc68af88fc21007209fc6dfbf4c496b89dea4b3d2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        spo0lve.exe
        • Path C:\windows\SysWOW64\drivers\spo0lve.exe
        • Size 11.3MB
        • SHA256 b74f6dc939558a6a409af9e989ced3b44da56a4ad07a718123f0dfb6fe1217a8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download