Overview

overview

8

Static

static

3

2026-05-31...ar.exe

windows10-2004-x64

8

2026-05-31...ar.exe

windows11-21h2-x64

8

Analysis

  • max time kernel
    148s
  • max time network
    94s
  • platform
    windows11-21h2_x64
  • resource
    win11-20260513-en
  • resource tags

    arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
  • submitted
    31/05/2026, 16:01

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-05-31_fee779c94751ce22227ac6c6d3a32097_cobalt-strike_elex_emotet_hijackloader_icedid_remcos_vidar.exe
  • Size 2.3MB
  • Sample260531-tglfnset2l
  • SHA256 5429ed4e8530d1719ebba232e2e891ee529b244f97ff6319b17e1f1b24a9fc19
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
defense_evasiondiscoverypersistenceransomware

Malware Config

Signatures

  • Drops file in Drivers directory 3 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Sets desktop wallpaper using registry 2 TTPs 2 IoCs
    ransomware
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies Control Panel 4 IoCs
    defense_evasion
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-05-31_fee779c94751ce22227ac6c6d3a32097_cobalt-strike_elex_emotet_hijackloader_icedid_remcos_vidar.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-05-31_fee779c94751ce22227ac6c6d3a32097_cobalt-strike_elex_emotet_hijackloader_icedid_remcos_vidar.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:4940
  • C:\Users\Admin\AppData\Local\Temp\2026-05-31_fee779c94751ce22227ac6c6d3a32097_cobalt-strike_elex_emotet_hijackloader_icedid_remcos_vidar.exe
    C:\Users\Admin\AppData\Local\Temp/2026-05-31_fee779c94751ce22227ac6c6d3a32097_cobalt-strike_elex_emotet_hijackloader_icedid_remcos_vidar.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:3160

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        7zFM.exe
        • Path C:\Program Files\7-Zip\7zFM.exe
        • Size 3.3MB
        • SHA256 3e9290cfa36248a2f393376405639836344ea98a8e898a74ba87b0fd66cdff67
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        7zG.exe
        • Path C:\Program Files\7-Zip\7zG.exe
        • Size 3.0MB
        • SHA256 c6fa8db4eff9af650fdc7c32c9ad359cf4380ccf7d25fc9ff8ad8a51623be32e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Uninstall.exe
        • Path C:\Program Files\7-Zip\Uninstall.exe
        • Size 4.7MB
        • SHA256 a7e8445466e35c6cbc090205f2334e40be6ec7c7e2b5821e604a5f584e4fb7b4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        InspectorOfficeGadget.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
        • Size 4.7MB
        • SHA256 662c311454a53b2cd25a5fad71bd51cfdacc2a4ce880e17e36b988d9336506b8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        IntegratedOffice.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
        • Size 8.7MB
        • SHA256 b2d9740eef0e5bd022d6535cf098ebe9d6775af92da112e20ac0924621cfa257
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MavInject32.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
        • Size 5.0MB
        • SHA256 95326fe027b0d23cc9560ec5f304fa615d4239916a80f980389213faafbc5611
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appvcleaner.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
        • Size 4.4MB
        • SHA256 a6e2251e05d5d3cbd8f45ce3ce81494e27be4bb5c1eccb5a89f9bc6ec3ba85b7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VSTOInstaller.exe
        • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
        • Size 4.7MB
        • SHA256 ed00d1ccde14de2bd16c2c77e9e6f24083a07a1254ab9c4acee6b77da5b52318
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrmstp.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        • Size 10.7MB
        • SHA256 ae9b44ef5ec0b92611a1f458463edc35cbe03ac2b5283442720f496430011c3f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_pwa_launcher.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 6.4MB
        • SHA256 9e63f9f0caf84824cd2d02881d99b4915a383c9abebf66ce172b7207518b0b44
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevated_tracing_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 8.1MB
        • SHA256 b2112c5a0477d262c2c51450507dee107edf4c85de4470167425892610cc4e0a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 4.6MB
        • SHA256 0f8ef53a4e972a9365fddbe2b0c3278036c8fa2a98c94a2900a1148b2a7b90c6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notification_helper.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 6.3MB
        • SHA256 4970f2095a896baedf82dcbddbbe3f90a56750fccd147579edc4fdd6bc958d5c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        os_update_handler.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 6.5MB
        • SHA256 11b4e45b2a74884a34aadf0b4a5bba06d3a20446fcbd3c674688c61747a9aef8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 7.7MB
        • SHA256 33c8b4c690f172d887215f22e3062de80d9684169511ad61255278933208d67f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_proxy.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 6.1MB
        • SHA256 1fca3b0c5025241fa43e0aa5df8d64b110a13584c6024ebe521f72f3e2ddd919
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 4.7MB
        • SHA256 7fb6afef6be26060eec35c4a76d2597ddc8aabf5d6b043933375a710ccfb45e6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 4.7MB
        • SHA256 62d97a7c74ca75005864733ee97a2fa6b3c39695939e016fecbef71118b8b175
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 4.7MB
        • SHA256 cc675cf68db464f1af929a7f7f5d35dc3cab71878bd1710f2418b5b350280eb9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 4.7MB
        • SHA256 14d0ab5c2a1f0b2c7f1e2a915907b8d1802a844b0a9f4b4fd87678332a185351
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jar.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 4.7MB
        • SHA256 4539815071353f5c74b0f68a7d93671d8e7430807c88e989e87d749c6280c941
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jarsigner.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        • Size 4.7MB
        • SHA256 da9c95954a1ceffc72a1bd9c0c2264e242acf9b79f8e445dd80cd7d095116b3f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 4.7MB
        • SHA256 87fd7cda3a0749ba9a6d84c3ffdfcda61b16ee41643f94c9b52ecbd733e8bd64
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
        • Size 4.9MB
        • SHA256 dfa406603ff55cba98ffd7bc3b9f54cd9181c4d941051566e072afb60bb6ed90
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javac.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
        • Size 4.7MB
        • SHA256 74de0a7bc932ac06ba522521e8c219f32dd6078acbdd286625b355fbacba7e2d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javadoc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
        • Size 4.7MB
        • SHA256 1fb77b495dd85507279aaa40a58366d3608f35efbb23b1ecd7082c7f4e439733
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javafxpackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
        • Size 4.8MB
        • SHA256 dd840f0ef405a0f66b6e32877a568c684b884b268fb10c0329dceecfaf92b5ff
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javah.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
        • Size 4.7MB
        • SHA256 4363830121d7a6ed2d7e8092af854a85d8117770818fc77771410f00b0bb61fd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
        • Size 4.7MB
        • SHA256 a2a4f58c21a65eaad2715166a9e84842635ec6618ad94a538dd7f1ab0832052a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javapackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
        • Size 4.8MB
        • SHA256 283836fd247c4febc3881c46de67c9c5eaad0f48d7726bda0c33cee0cf1e524b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaw.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
        • Size 4.9MB
        • SHA256 1e490cf287171c134b1106c1d6c64bb9c0d3f2fe5f51e5bc1647f9254714b774
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
        • Size 5.1MB
        • SHA256 77dc1f8d6edf1a3be6a4c34af7d4d76b5f6a221a7633990e01d751799e0d66d9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jcmd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
        • Size 4.7MB
        • SHA256 93fee9b9ca066523f6199bae21902bec426df5cc0f3120e569dc03956ae18612
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jconsole.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
        • Size 4.7MB
        • SHA256 2e35330926b4feca8a0aa77521b41f39523a86f6d821af821d462a659360ffc6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdb.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
        • Size 4.7MB
        • SHA256 51b01d4e81317c0990ace5ffeb0e9bc755a3fc9e2ab829f2f643a11bfce8d493
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdeps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
        • Size 4.7MB
        • SHA256 eb83c970aa189c26859b857d83bccec42347244d0168c360be512149bfecd3b9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jhat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
        • Size 4.7MB
        • SHA256 be34ca60c0bb5486460cd820f257f32d77facf78c944d4ab3b172ef28d5726e2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jinfo.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
        • Size 4.7MB
        • SHA256 f81513fed3ecb95bcd482083dca5a39d737bf615bbe0b9be0f63948d504dddc2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jjs.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
        • Size 4.7MB
        • SHA256 57f6e5f56365fe70231055162482313f84496898e337ebe55e7738f77106e901
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jmap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
        • Size 4.7MB
        • SHA256 f5a6a8abc26b91e1d87e6eba4726352e3c02051a291d1b3837c49af65af15722
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
        • Size 4.7MB
        • SHA256 75c7c5e3dd405b0c79729e02121966e1872bb08c4fe204cf5325cce7a9043a0a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jrunscript.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
        • Size 4.7MB
        • SHA256 8b3a9afb5ce8b387e6475bf2fdd122958e7ac4f24e432e66d44f7b8f9d0b3294
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jsadebugd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
        • Size 4.7MB
        • SHA256 8420f7f7b424df7783e27c3ffa07177e0189abbf9c83f3cc188895ee857e5958
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstack.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
        • Size 4.7MB
        • SHA256 0d5938b4bbd816ae7f45de4e543cf7aca50db6386d112b266a3d5016c254439e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
        • Size 4.7MB
        • SHA256 5496e839432ea1b56f0f86a3192f79d9863c8ad6aa01a9f52b88452751c0ce25
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstatd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
        • Size 4.7MB
        • SHA256 7d4c6dddaab8aa76fa4931bf714838772d6c130e6626b8c97344024bbe93177b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        keytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
        • Size 4.7MB
        • SHA256 c7e0e6331b519f8ae60ccc34d956a50cde3895c09eb475cbc7cebad06d249f14
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        kinit.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
        • Size 4.7MB
        • SHA256 df08f6bffbad891ccb3b80b8eaaf633d8aec13358c0cce196605b2f3d8fbfa18
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        klist.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
        • Size 4.7MB
        • SHA256 b7c9d8f8081b578b7598221efc3382d1a729c83d581b3e999040f447adf1ed45
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ktab.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
        • Size 4.7MB
        • SHA256 07e14665cfb30e5183fcadfc8a5dcf2e05299fee1144dad041b2b08ab3a89bd3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        native2ascii.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
        • Size 4.7MB
        • SHA256 2d869e4a6447c9e3b86c255ab8c1b09cd262a7600fe85ea73c5364ab24b92db6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        orbd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
        • Size 4.7MB
        • SHA256 98e41930a6f311718786cbd8027bfeee98dd5cc8ee653e6043cc890ebb0020a0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
        • Size 4.7MB
        • SHA256 2c3b52fed7ebc86f8abaa951e95e8afc3a9765024776b7e953caa7cb232223b2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        policytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
        • Size 4.7MB
        • SHA256 8d36fa81686841213f3645f41245a24535bd6b850d235b93c7ff2d1ef0a1b6ba
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmic.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
        • Size 4.7MB
        • SHA256 5dbd29200ec6e116d49dce6cdefdd0f508cc75906e029844c3a4d014045f43e9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmid.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
        • Size 4.7MB
        • SHA256 bdb7731d5a828fe03a258d3ca3db73cf302b82b47f5a171be8cbe5ebf4e2002b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmiregistry.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
        • Size 4.7MB
        • SHA256 cb63f87f421f3a57079a9c519a5fc0ecacbd3832b186f8cf8af496be366fb66c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dotnet.exe
        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 4.8MB
        • SHA256 141a597fee7e5363e9390d1898a7a44afe1381074cb9838aef960e33b85bf8f0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 4.7MB
        • SHA256 945591f337a333e9257ddf22ad81636ea54716ca59b1182350a4e2cf06829a00
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 4.7MB
        • SHA256 745e31806fd5d722be0b6561eb2251a3313f3c0a33062c650dce05b3f8db193d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 4.7MB
        • SHA256 a4e10f3c93b951ec696ecb263563e79acb980e5f3c289b38891601aa4a7ad288
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        spo0lve.exe
        • Path C:\windows\SysWOW64\drivers\spo0lve.exe
        • Size 2.3MB
        • SHA256 5429ed4e8530d1719ebba232e2e891ee529b244f97ff6319b17e1f1b24a9fc19
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download