Overview

overview

8

Static

static

3

2026-05-31...ar.exe

windows10-2004-x64

8

2026-05-31...ar.exe

windows11-21h2-x64

8

Analysis

  • max time kernel
    148s
  • max time network
    149s
  • platform
    windows11-21h2_x64
  • resource
    win11-20260513-en
  • resource tags

    arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
  • submitted
    31/05/2026, 04:57

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-05-31_39f03ff3a4516fac35f6265752674f5c_cobalt-strike_elex_emotet_icedid_remcos_vidar.exe
  • Size 847KB
  • Sample260531-flk4tabw8j
  • SHA256 451a7541b74ad104fdc40c72f222392826379a6602aee3d0aaaf70f6ea467d93
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
defense_evasiondiscoverypersistenceransomware

Malware Config

Signatures

  • Drops file in Drivers directory 3 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Sets desktop wallpaper using registry 2 TTPs 2 IoCs
    ransomware
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies Control Panel 4 IoCs
    defense_evasion
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-05-31_39f03ff3a4516fac35f6265752674f5c_cobalt-strike_elex_emotet_icedid_remcos_vidar.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-05-31_39f03ff3a4516fac35f6265752674f5c_cobalt-strike_elex_emotet_icedid_remcos_vidar.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:956
  • C:\Users\Admin\AppData\Local\Temp\2026-05-31_39f03ff3a4516fac35f6265752674f5c_cobalt-strike_elex_emotet_icedid_remcos_vidar.exe
    C:\Users\Admin\AppData\Local\Temp/2026-05-31_39f03ff3a4516fac35f6265752674f5c_cobalt-strike_elex_emotet_icedid_remcos_vidar.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:2264

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        7zFM.exe
        • Path C:\Program Files\7-Zip\7zFM.exe
        • Size 1.8MB
        • SHA256 ad1f8df13da2ea8f4729a35af7031339c47dcb2eeeac909c3e86ecbe931f15de
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        7zG.exe
        • Path C:\Program Files\7-Zip\7zG.exe
        • Size 1.5MB
        • SHA256 e99b71b1e226786a66800d91497cecb4fafa3afec8bd8e32d627f1a7532eb8ea
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Uninstall.exe
        • Path C:\Program Files\7-Zip\Uninstall.exe
        • Size 862KB
        • SHA256 03ca4e148bea83dbd6699401dac6180d6355ac24783202898b56625be65144a8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        AppVShNotify.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
        • Size 1.1MB
        • SHA256 04c09a81d3e80ea1019a30183f844ae07b590581c1fc6d8088bbba4f586a8e94
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MavInject32.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
        • Size 2.0MB
        • SHA256 fb3a1ab31227bc5c15b2990a0cf7c41fc77ae82bd087b7b57649fe3d4ebd4ecb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appvcleaner.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
        • Size 3.0MB
        • SHA256 5bdb008612cbdf9c1b4e0706e52ff8c0ad8d0a18875fda27646d1e6036d555cc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrmstp.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        • Size 7.7MB
        • SHA256 69f48daa8b204fef1731075f715c868e80a20b062dc56963815395d028f90f4c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_pwa_launcher.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 3.4MB
        • SHA256 acb95366310f9f5af1ba99ad0b18cee72d2965af89609caf55d28ff138538f47
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevated_tracing_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 5.1MB
        • SHA256 a5efa4f29b5a44b2a7427ade34eb45a435e43d3cb16f235bf20a2a5f2b13dcd2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 3.9MB
        • SHA256 cfaad4a9e86beb196ba1347f0d3d76a6d831319c43b07484f089f71506111b2e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notification_helper.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 3.3MB
        • SHA256 4e2643d1fd42db17d75cd330a34fe5f1ece1df0515b24c6b815cbaa6b416c39d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        os_update_handler.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 3.5MB
        • SHA256 7595435f44f552a95ed219d47d5c65392b6bc0a4155b31501f19ac19bd7d97a2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 4.7MB
        • SHA256 a2b16e36364fbbb7560ef32ff78732623dbaac9374a358a119231aa3c402c03f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_proxy.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 3.1MB
        • SHA256 688e5ff495781061f5116a77005b34411c388965fba48d2764b83c65b8bfb1cf
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 1.7MB
        • SHA256 984e542a8e7984b38dbe13c60a31c1aeecc64ade965f3c11098cd7659ce45253
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 1.7MB
        • SHA256 c74a3877db044626900900dfded06e0e40824dda32c80761ff0dc633bc551dc5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 1.7MB
        • SHA256 45906000d4ca951f5df5e4fd681e97bf031643c7038a95a81854bdaf60489489
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 1.7MB
        • SHA256 8e283cd38aac0b834858e6547b1ad1307792642f6f21f855c283a610f5485f0d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jar.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 1.7MB
        • SHA256 f2516beaf698331548c745438722c1a3b6219380973915e4b26f1277e33d261f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jarsigner.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        • Size 1.7MB
        • SHA256 726cf379526b39678c3ec35131e483216716f0359a1eadc30c1fc21140785867
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 1.7MB
        • SHA256 e90bfc7a3585f57732e0a8e992cc3bee5237506734fb740f85beff03d346e2e3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
        • Size 1.9MB
        • SHA256 3df0cb8989130cc4ff105f63a0031e932440e7e1dc8a3b6e31f2cb6c7071eb49
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javac.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
        • Size 1.7MB
        • SHA256 8128a9c1ac1d9cb44891c0a71deaf5ee02ee9a05f97c9b8b70800802cdf03009
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javadoc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
        • Size 1.7MB
        • SHA256 1b00b6bf000ef26a3b06485d39561b92f03883ce1304d29977c6bfd2f944709e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javafxpackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
        • Size 1.8MB
        • SHA256 17fe4a6e55490f891342ec13279c1f1b960309f7dddc9a11911d3bf6b20e58f3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javah.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
        • Size 1.7MB
        • SHA256 5324a5677d0168e59e88bcc741e0541d6d4c61cef99d23f92736d4eaa7645694
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
        • Size 1.7MB
        • SHA256 09bbe304753dbd4d004e7c3bde725338417478d7f0682480e25fd3e8392da2d8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javapackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
        • Size 1.8MB
        • SHA256 e41feba860da50372037a5b2e8f04b63cdedee0d57dbc2fc520bc6f507628145
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaw.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
        • Size 1.9MB
        • SHA256 6698a0cf738716b9db4a1165175a51c718c94f58739953601592c910e6504e1f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
        • Size 2.1MB
        • SHA256 a57784aaf095646781f3dca60163f5792e5f16700660e451ba5d859405d33cc8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jcmd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
        • Size 1.7MB
        • SHA256 800ae7e1635443a1f94078a25be080f6089e2b8787cee4f4cfedf3e9752daf6d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jconsole.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
        • Size 1.7MB
        • SHA256 7596004f5ada36dcf18e7043fe06b9053b7f5f14f2293f7ea5e4803592160226
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdb.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
        • Size 1.7MB
        • SHA256 d1e94a615256938b22267a36f4db62f83b07e920d8194b6dcac55dca3b34037c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdeps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
        • Size 1.7MB
        • SHA256 928bc16021732f717bae1168b047b546ad8271c77c2c2da3f0f18026bb000f93
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jhat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
        • Size 1.7MB
        • SHA256 19f39d47b06b69ec95c9adf711f84f6eb16482a4a6e2d81e8eb85de628ea19f7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jinfo.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
        • Size 1.7MB
        • SHA256 5a7cf2666dd7275127155ce0f2e5e6d24feec2906790ef37b8f0b6e80672698a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jjs.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
        • Size 1.7MB
        • SHA256 9e1df11c40d2663cd76acc5904678af4bbb4de9bc156e653d0e44d42da2d5441
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jmap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
        • Size 1.7MB
        • SHA256 36632593dd3fe379ad704b035a13eb7f40f8c39b1c4bcc7fc8d2ba58397ba103
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
        • Size 1.7MB
        • SHA256 85cf8612d5caffc62fec94723c704368cd7aa9630f941e745d70d3964e669fe6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jrunscript.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
        • Size 1.7MB
        • SHA256 8d51f91083afcc6dc93077ab61cf5588822209413f4117c613856c3cb5f48c44
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jsadebugd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
        • Size 1.7MB
        • SHA256 51d7179ae466bca70ca0381b13875a11f252e33f663949e757a3fda1386002ac
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstack.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
        • Size 1.7MB
        • SHA256 9381ec1f30e10ab024f3e5ce7a15c64452891449d4ddc8f806d3cdcd80618946
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
        • Size 1.7MB
        • SHA256 148152c8e7631110c63145705c217d4634f8748f2f0d7a5c7788a365d91aa2cf
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstatd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
        • Size 1.7MB
        • SHA256 f453a8f5d7db2ed53df8403c0ce5ba339b2776646c6b2d08302987f0bbd4aa8f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        keytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
        • Size 1.7MB
        • SHA256 beb84ada2f00317d115316e33dfcb151b1413a1fc3e7369c9187010570491ccf
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        kinit.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
        • Size 1.7MB
        • SHA256 6d02c8c9b516202e0446f8a56bb5a150afa6019e17779e012b161a21bdf7bcd3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        klist.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
        • Size 1.7MB
        • SHA256 6fef0dc1f358fcbdbe64789aa7275107401cc54f74ede1a773345cf23cbfd481
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ktab.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
        • Size 1.7MB
        • SHA256 9033fb5eea896cbf180f7a76f926cd75df2b894286617d860c019db29348ce7c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        native2ascii.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
        • Size 1.7MB
        • SHA256 7abb86e947400021ccbd0435551e2b2dab4172f004fe770729c4f1413d581337
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        orbd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
        • Size 1.7MB
        • SHA256 a5210f0f73ff8de0b0ec0532810467587ee6fd6657ec7b0c418b554e9377c0c6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
        • Size 1.7MB
        • SHA256 6bb48d3fbced6013d4f5a6bc02e06a68a82e86c45ca7a9110b844a7c5805e9c8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        policytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
        • Size 1.7MB
        • SHA256 65d63a095b6986093c642ed88e7f5c2beba9d2e401509282a13614018e73d50b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmic.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
        • Size 1.7MB
        • SHA256 29377c254bc4b6317051a7c5bc7091a6b495a8aced2632da57bb81ff9011fb7b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmid.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
        • Size 1.7MB
        • SHA256 d7119f7b5fc7bd8a4dea0217258336103eaaa707c729cf718b6798d9ee160b92
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmiregistry.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
        • Size 1.7MB
        • SHA256 77bcfbc6d4df83afbae6a3edae2b1acf490bf77583a7b6e29fcb0a306d0b7338
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        schemagen.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
        • Size 1.7MB
        • SHA256 5f4e868ff79980ebbdd9c1d26c6b1221c16428298ecf1cef7d71d92f0ddc1577
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        serialver.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
        • Size 1.7MB
        • SHA256 28a290d69612a145b16c8c074329d593cbe2b99c00292e31d6a9b9302f4ab9c1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        servertool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
        • Size 1.7MB
        • SHA256 6c61136b7e6a6363b4e9d22dee7fb6f94ff1390ee531220002980dbec2467276
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 1.7MB
        • SHA256 956516915506b5bc8213997c292f7a4d98b0dee6e3df7247c902a69ba10fc642
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 1.7MB
        • SHA256 a0452b814a51f76bc0b724123a7d61887ea64a2ed531cd40e9c8be1de2957398
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 1.7MB
        • SHA256 44368faf6725595fb98773cdbfa8cd800e80aa866d5c6dba14cdc7eea76a9a55
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        spo0lve.exe
        • Path C:\windows\SysWOW64\drivers\spo0lve.exe
        • Size 847KB
        • SHA256 451a7541b74ad104fdc40c72f222392826379a6602aee3d0aaaf70f6ea467d93
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download