Overview

overview

8

Static

static

3

2026-05-23...ar.exe

windows10-2004-x64

8

2026-05-23...ar.exe

windows11-21h2-x64

8

Analysis

  • max time kernel
    148s
  • max time network
    150s
  • platform
    windows11-21h2_x64
  • resource
    win11-20260513-en
  • resource tags

    arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
  • submitted
    23/05/2026, 15:13

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-05-23_c52e7702fbdaf02e181487f1c0622e18_cobalt-strike_elex_emotet_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe
  • Size 11.3MB
  • Sample260523-slps8aes5y
  • SHA256 b74f6dc939558a6a409af9e989ced3b44da56a4ad07a718123f0dfb6fe1217a8
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
defense_evasiondiscoverypersistenceransomware

Malware Config

Signatures

  • Drops file in Drivers directory 3 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Sets desktop wallpaper using registry 2 TTPs 2 IoCs
    ransomware
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies Control Panel 4 IoCs
    defense_evasion
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-05-23_c52e7702fbdaf02e181487f1c0622e18_cobalt-strike_elex_emotet_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-05-23_c52e7702fbdaf02e181487f1c0622e18_cobalt-strike_elex_emotet_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:5304
  • C:\Users\Admin\AppData\Local\Temp\2026-05-23_c52e7702fbdaf02e181487f1c0622e18_cobalt-strike_elex_emotet_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe
    C:\Users\Admin\AppData\Local\Temp/2026-05-23_c52e7702fbdaf02e181487f1c0622e18_cobalt-strike_elex_emotet_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:3292

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        7z.exe
        • Path C:\Program Files\7-Zip\7z.exe
        • Size 23.2MB
        • SHA256 c91c26dee95e6aeb422e716380eeb12d1cf7141553d5afc4ca7355c41a8e96c6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        7zFM.exe
        • Path C:\Program Files\7-Zip\7zFM.exe
        • Size 23.6MB
        • SHA256 e038d65a922a6fbad1f5b7dd7f358d56a4433c7c97e5be35a9bb78b3f893096f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        7zG.exe
        • Path C:\Program Files\7-Zip\7zG.exe
        • Size 23.3MB
        • SHA256 b0af84fac58b28c6c2a76f6c0d4a2849ee223b3df69dc630f384683e6ddb8095
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Uninstall.exe
        • Path C:\Program Files\7-Zip\Uninstall.exe
        • Size 22.7MB
        • SHA256 2cae95b6b6d9bf418a0ead7c68fef4f38d7dc08b2faf8855b3a18ac300b02987
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        AppVShNotify.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
        • Size 22.9MB
        • SHA256 1a4a102f542a95fec7e471ca911c8648446094f2e13e7f36c40b971f0d8eeadb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        InspectorOfficeGadget.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
        • Size 22.7MB
        • SHA256 dc16c7d0ce1a21f39d71f9ff514ae53ab457b86d6dfebf90ae7c33c553cf6e5d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        IntegratedOffice.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
        • Size 26.7MB
        • SHA256 4af006aaf0cee262e8d2c57d99d0c5e64147f246891f56ebcbbfb2d083e7a96a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MavInject32.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
        • Size 23.0MB
        • SHA256 892fc33cab4d31101b122f73fe61c617da645cfdf8856bafabeaf9f518a03543
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        OfficeC2RClient.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
        • Size 46.1MB
        • SHA256 d0fcdd0cf06e69736a05554951caf2fa9a3f4728c4c056bd9101ad846e9bc4c5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appvcleaner.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
        • Size 24.8MB
        • SHA256 d3569e7211e9218132ffb6d9410ca2b37a5cd3f08505a82d0bb712b698fe2183
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VSTOInstaller.exe
        • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
        • Size 22.7MB
        • SHA256 549aa27abd92cd66107f1acf4c070d8ecb38ccaed32eb5a48398f74ed45ee8f7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrmstp.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        • Size 28.7MB
        • SHA256 2a0e5e6f12b8706c9508c33dc788f13cc78d714049773ccc068b982e83586d04
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_pwa_launcher.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 64KB
        • SHA256 79a0b1f3b0958e830806c9254c2ba2af079ac99713004febcc3610200c9f504e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevated_tracing_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 26.1MB
        • SHA256 ba686a4932b5ac2e1f202939a3fccf223353ec647fa75de7d5699d7ca81d4561
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 24.9MB
        • SHA256 08f9c60cd4433498b6516121e45e974ff0f4bbe47a243b5beb4d5d97cc5d8585
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notification_helper.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 24.3MB
        • SHA256 d8951e77a355c0fcb6f246d362b64da2fc26eea3ee4200724978529a25d80ea3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        os_update_handler.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 24.5MB
        • SHA256 347c8c73fca47f780d8c9c0456a516dbf3f0dcb313c6262651a59f148cc2352b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 25.7MB
        • SHA256 7ff4b7c0feaf43ff7dcdcbbf7b45afa4df94e25fcbc57f4d6322013b1910ab1d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_proxy.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 24.1MB
        • SHA256 f9d8203b23dcee8ca2ee9df2114eb966eeb8ca752a50c2b8b97b0c9fbd835b13
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 22.7MB
        • SHA256 aeba8d7b2ff8d38b5e319501f41c4c92432c89e34f0af8a59b41e713151cbf6f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 22.7MB
        • SHA256 97873195d37c50d39a03992522978ac1ee6a441d4a4b903adb4524d410cf881c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 22.7MB
        • SHA256 7a92f84a8ec7b489a28885f99dcd128f5740358e28a21a3f292cb24c557ba910
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 22.7MB
        • SHA256 4373c3bd682d823bec90abe20dd702e54ee12eaade2c8f6d0d7005a367308570
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jar.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 22.7MB
        • SHA256 6a5ff1ca7ea880e1af569588f1c3afc8abd7ab22c88080cfd2268ade47809db8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jarsigner.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        • Size 22.7MB
        • SHA256 29c484a9a7702e02e884974c77b71cfb5d16516166ef2b7f0c8af5b23ad389fc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 22.7MB
        • SHA256 52c0c416b45bc11b921eb70cc0aa40819d4373100982a8f5676d0a95ed0cce16
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
        • Size 22.9MB
        • SHA256 2c8caffec18067077bee802dfc0092c152d62d31981b680d6e9350b07f19b6a8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javac.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
        • Size 22.7MB
        • SHA256 ea7d2ad7f503303893ad8ad89ba7dcd79f1082afad126060dc8daabc8a04a7e7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javadoc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
        • Size 22.7MB
        • SHA256 4e348ac03d241c083059a14cc1fc710be381ce0ce94b51e25ac54b187739d3bc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javafxpackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
        • Size 22.8MB
        • SHA256 2f1e22b672e15cf8f25e8978601dc679d366321e7085a1b9058e8d538bf91a1f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javah.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
        • Size 22.7MB
        • SHA256 a0a477b5fcfbd1993d3c8017b5b4722ec34da0edec09e1fb581f50c7682e0558
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
        • Size 22.7MB
        • SHA256 2e08eb793a7a83cf1ec6d9946c044045c6940736647d8575a725d150adf2e11e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javapackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
        • Size 22.8MB
        • SHA256 7aa53335cbd8cd842c64a1ccaf948ba6189bca4d3fe4fc438bdbb3833f6b36fd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaw.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
        • Size 22.9MB
        • SHA256 4a907c4fe2ba9999e9e54de8ef8963b1bc6324957af2dd1de2ed6a3fcc03578e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
        • Size 23.1MB
        • SHA256 f325c0688e5f5f727c7dd33790e9ba8c3e19380067c7dee7991c7db10b399b7b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jcmd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
        • Size 22.7MB
        • SHA256 cbe899d03a7d8294dcbb5ad6c5b93be05f8661482ce146ffa2369c2acff70aad
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jconsole.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
        • Size 22.7MB
        • SHA256 bec6aca8a9965a913119ae128634d3a6c4e2c6ef27debd00122b6346c8a9e3de
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdb.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
        • Size 22.7MB
        • SHA256 5f34ff4d2b416d78a9e0bba8c643cf08d208c84c43c176edf2706405425ea7e6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdeps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
        • Size 22.7MB
        • SHA256 b0a800038bfb3fd2c12490e67f7f7fe6bd0a15af67340bbacf8e3b4bf058df0e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jhat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
        • Size 22.7MB
        • SHA256 03ae6b20bbb2226ecd51a5f3eab8ecb69eca0fe24c25d71c3333849b8a3c6193
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jinfo.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
        • Size 22.7MB
        • SHA256 c7546c27a97b2f5524dd958796ae9770882e40ff307738c99e1466e355051f6a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jjs.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
        • Size 22.7MB
        • SHA256 41fc81fcceadd6ecbe579c329ff586adf1801c085c7cf978c1defb8451e391ba
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jmap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
        • Size 22.7MB
        • SHA256 f1e6f8427b45eede4d78a716b5ff79a1ab23632b96da7735e917c600eb5dea67
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
        • Size 22.7MB
        • SHA256 b52dfd093a1938e13590e6a84d37d3c962402c9505a6091dada06ddc16813bc8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jrunscript.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
        • Size 22.7MB
        • SHA256 0611fe5916e94ed0dd96284a2b08349eb3c8cd33e9481c5d4cf44c368dfc7b02
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jsadebugd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
        • Size 22.7MB
        • SHA256 fdcd8c5c2b86e03261e3a777bdc6ad5755a6f054253dcb6c328ab678d46bff43
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstack.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
        • Size 22.7MB
        • SHA256 9ed123837ad4d7695e64e51959edee75affbaa0436ea0690da9b4c6bacba1f0b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
        • Size 22.7MB
        • SHA256 be1ef555c2a6773943e30cb1a8f6f58f5d029d9c00ca961a22a9d7db83014e41
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstatd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
        • Size 22.7MB
        • SHA256 d4e74b51a6dacce923988952764d1de39be19709f02e6fc9680fe4455f8c39a4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        keytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
        • Size 22.7MB
        • SHA256 7fbb9326e85e56da73f3030a8e19f08633915ea75eaedbebea413ad108220f9a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        kinit.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
        • Size 22.7MB
        • SHA256 5a8a939f19c80ba0adb91cafe6693dba0650cca0db85ca9d64081e4b7a6ab0a4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        klist.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
        • Size 22.7MB
        • SHA256 730fd5ba0b8f86c2b657ed03ffe4c44c70ef61b802b2175082f4feb62c747481
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ktab.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
        • Size 22.7MB
        • SHA256 52a509995a808b34b70d4674cadd9fb9d92e68070ede158327c3f56a00684253
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        native2ascii.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
        • Size 22.7MB
        • SHA256 bc739dbc1ca1f31a1db028038e837ec63bc8c3d7406f203a799f95c39fc34045
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        orbd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
        • Size 22.7MB
        • SHA256 a511f0a0cd65735ac5674e6ca8822803b0bed9cbc605cd0ed278998d0400db6d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
        • Size 22.7MB
        • SHA256 b508a17724eb16c3fd123fd8081f851ba76e1446fab6d04bae4c736e80fa0a19
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        policytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
        • Size 22.7MB
        • SHA256 71a1f0c7b6ec9638b34cbbd9d339ec9ad24d05cca7e2df77558dcdb356af0362
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmic.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
        • Size 22.7MB
        • SHA256 20744bd9a79c144c789d6201054032e6d7a2f3b96445fab629b77d47d8a7e6f1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dotnet.exe
        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 22.8MB
        • SHA256 552719dfe15d342cd7b0493a848c64b73776c0a10856321276dc865f1060de28
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 22.7MB
        • SHA256 01936f4035c53fe8fc0649aab190309a2c7bf408baecd7f430546df4d370581d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 22.7MB
        • SHA256 8f68e84414810ebe3ee3a9cfc68af88fc21007209fc6dfbf4c496b89dea4b3d2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        spo0lve.exe
        • Path C:\windows\SysWOW64\drivers\spo0lve.exe
        • Size 11.3MB
        • SHA256 b74f6dc939558a6a409af9e989ced3b44da56a4ad07a718123f0dfb6fe1217a8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download