Overview

overview

8

Static

static

3

2026-06-02...ar.exe

windows10-2004-x64

8

2026-06-02...ar.exe

windows11-21h2-x64

8

Analysis

  • max time kernel
    149s
  • max time network
    149s
  • platform
    windows11-21h2_x64
  • resource
    win11-20260513-en
  • resource tags

    arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
  • submitted
    02/06/2026, 01:01

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-06-02_23c2f83fd8f8bdc0df0d48946a95df79_cobalt-strike_elex_emotet_glassworm_icedid_njrat_remcos_vidar.exe
  • Size 9.7MB
  • Sample260602-bc9ctsbx2l
  • SHA256 00b756f18d17abb989f2497297187a499c48f5c13953020f0285d0f9d73972d9
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
defense_evasiondiscoverypersistenceransomware

Malware Config

Signatures

  • Drops file in Drivers directory 3 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Sets desktop wallpaper using registry 2 TTPs 2 IoCs
    ransomware
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies Control Panel 4 IoCs
    defense_evasion
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-06-02_23c2f83fd8f8bdc0df0d48946a95df79_cobalt-strike_elex_emotet_glassworm_icedid_njrat_remcos_vidar.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-06-02_23c2f83fd8f8bdc0df0d48946a95df79_cobalt-strike_elex_emotet_glassworm_icedid_njrat_remcos_vidar.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:4868
  • C:\Users\Admin\AppData\Local\Temp\2026-06-02_23c2f83fd8f8bdc0df0d48946a95df79_cobalt-strike_elex_emotet_glassworm_icedid_njrat_remcos_vidar.exe
    C:\Users\Admin\AppData\Local\Temp/2026-06-02_23c2f83fd8f8bdc0df0d48946a95df79_cobalt-strike_elex_emotet_glassworm_icedid_njrat_remcos_vidar.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:4428

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        7zFM.exe
        • Path C:\Program Files\7-Zip\7zFM.exe
        • Size 20.4MB
        • SHA256 8184a004c8a499294581e28e6917039bf5fa8e245070f5856d22b5c41f985bad
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        7zG.exe
        • Path C:\Program Files\7-Zip\7zG.exe
        • Size 20.2MB
        • SHA256 1a47a897b8fc5351b1235854e3faed39932e7017af17c74cade3c1666c7a0a26
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Uninstall.exe
        • Path C:\Program Files\7-Zip\Uninstall.exe
        • Size 19.5MB
        • SHA256 eeb7e782a8fa356d5ad8ae3d60c4034373da6cbc44eaf158c8de7f2589204326
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        AppVShNotify.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
        • Size 19.8MB
        • SHA256 64da9fe069070bf1934053f3004be578ffab44a92cec65d11f5ca471c3793771
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        InspectorOfficeGadget.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
        • Size 19.5MB
        • SHA256 7f5777a689d0146212a7bac602259437cb1ebf07db1272c7334900019f0324ba
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        IntegratedOffice.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
        • Size 23.6MB
        • SHA256 3858824159eff86067cf796830a72efdf68f3a5f7c6a817c5958f1a350260e6a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MavInject32.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
        • Size 19.8MB
        • SHA256 115df76b5c733e9e7c7a93c0dd3eed70d7756ed358e5f68e32cbb020727c90c4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        OfficeC2RClient.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
        • Size 43.0MB
        • SHA256 5c49f7a77f651d5766b187342b7ec95d86b8f834fc9409ad3aa1f658773374c6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appvcleaner.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
        • Size 21.6MB
        • SHA256 071dc80408f8e4512a36da2513e99101cc319596b3877a78c572d17893981d26
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VSTOInstaller.exe
        • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
        • Size 19.6MB
        • SHA256 01717c51d8abc713e8349aee4f199ba11f78a8e40659483936f4f09db90ed185
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrmstp.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        • Size 25.5MB
        • SHA256 380bf0a298a0d68744e7b996ae1ed3d86a00d762b5e237cf3a1b198a216bf72f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_pwa_launcher.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 21.2MB
        • SHA256 3b89f68cc561613b1f0abc550c339695d22e5db41a5a164e1e46fa739d96f9d7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevated_tracing_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 22.9MB
        • SHA256 17767daf5266c785380fd593d98b1a7b08ab5f19bb2ba3c8441e1f665d426ee1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 21.7MB
        • SHA256 544595e57d29c10a8def983e458f33832b5e1e651e7860526e1b91b7fc53c858
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notification_helper.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 21.1MB
        • SHA256 6f42ea2abab8cf42253547f6e71afaa4009db650318bf7d37c924b7578a9008e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        os_update_handler.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 21.3MB
        • SHA256 d0a69adbc9e812275b3213400b14269342885b217af0321415fc26c6e235d7d9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 22.6MB
        • SHA256 7570d470f9ee5e7d07f6dc6d915601d017df93728a811a618c5e0d22b356f839
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_proxy.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 20.9MB
        • SHA256 41712c33cb925122bf228e602cdce1dc0572e66f271d497747b71c7c4d15eb08
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 19.5MB
        • SHA256 433151133819223eb2a0a764be9cb4a3b18d98a8f8990479f1c233beb8ac99e3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 19.5MB
        • SHA256 b3cca79a54d7075ab0b01005d85f8b3aaf2ffe535a263a41afed57ff3376a356
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 19.5MB
        • SHA256 5af95bcaaf21c5f6e39dcbe3359bc1eab69cf6ce67792bbf500166c7c4b6f900
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 19.5MB
        • SHA256 ee94c3df45f9f6843e4a7596ee9319e91ce1bc1e7de92a7f39e6770b01ee7ab1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jar.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 19.5MB
        • SHA256 056f35341f330426512451f50172543d1c41b8d381452bcf1ca5cc9fbe505359
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jarsigner.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        • Size 19.5MB
        • SHA256 94603e2c51c306052ffee7acc1479daf7f8def452098f51b7bea7616ed560cfa
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 19.5MB
        • SHA256 c6a4428d8bf297bae2e674fdd800ca1bd30b2b8bfc3337acb7810d42ca06ce3d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
        • Size 19.8MB
        • SHA256 9746795a977c5988371d98471c3cfeed11fa40f5e4fadc10b529b8fbdc54ce79
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javac.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
        • Size 9.8MB
        • SHA256 6b6be5ffbf9bbe5fc01f9985f75534961b71f5645ea19d256709740d5e06f856
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javadoc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
        • Size 19.5MB
        • SHA256 1204ce2ca0ed4f8c7e34a190695641b83871c743b540cce691e87940e3b57a40
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javafxpackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
        • Size 19.6MB
        • SHA256 6cd55a8f614bf3ba24437537fd04edd1bbc9e8252672700f7f4430cf8b36fbcd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javah.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
        • Size 9.8MB
        • SHA256 c381ec65524a8420ff3632d600fb19c546737d02179aa607db0b64e418182d96
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
        • Size 19.5MB
        • SHA256 fc67eb7661a6e12428dc966fd2cffd7ade7d9215ef932764eb5b907a3d4e9363
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javapackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
        • Size 19.6MB
        • SHA256 19655a0e348e84f14ce1e60795718cfe8147a765198d4c9445e42e5a0cd9ed61
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaw.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
        • Size 10.0MB
        • SHA256 ff13c22434da3033aa57e56f989a92cd93def0870a520c1f34859fd7e50f0b4f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
        • Size 19.9MB
        • SHA256 82024f3d57c8d6c5914592062e7c0be2e64e667d4c5c96591351fb67bfc2671e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jcmd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
        • Size 19.5MB
        • SHA256 b26134dcca865147a296108e530705763e6464b1796ada34c779e6bb7ec56a0e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jconsole.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
        • Size 19.5MB
        • SHA256 3ddff52d08cf85170e753b6e352f2fcd971d7f053d34fa528135fb5147c61b80
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdb.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
        • Size 19.5MB
        • SHA256 2194202b79ae931dbbea04d8ef89989d778753460cad2b8cafa6f2cefb596d3a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jhat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
        • Size 19.5MB
        • SHA256 3d64ff6ed221e82d06ea24ad02e14bf71c5321d877c8ea7fc91c7daa55e7e9f3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jinfo.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
        • Size 19.5MB
        • SHA256 c73785a7ae1c1e5894f71ee59579038e6e9d53d6a4b6c7539d9853264451c108
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jjs.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
        • Size 19.5MB
        • SHA256 fd99c10666d806d7c64146a5cd502b91ae6a63c83c373d7b4a1596678a2c54b4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
        • Size 19.5MB
        • SHA256 b9407e6bb2cce4ecd5049bc21a39b668b242db072d5f95932a53ea1c32f8ef70
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jrunscript.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
        • Size 19.5MB
        • SHA256 e6a0412b3b91dc220a486966ae775c3d2af94f44ffb2a426fb1f04f5677e9837
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jsadebugd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
        • Size 19.5MB
        • SHA256 d492b40b08191d24fc72f6194ad1072e69e4fc524247921a9cad117cdbc5b284
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstack.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
        • Size 19.5MB
        • SHA256 5a99a441f00daf9d49ffa2f20b27accb5d5ef18f7305f694cfdff1a30e79f18c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
        • Size 19.5MB
        • SHA256 26556fe6cc8ad6da3c0044d26ea14de4c48848c4036fb7aa8f3a8c1c43c3508a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstatd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
        • Size 19.5MB
        • SHA256 766f712114e1f6ccfed65075fc08e7267c546f8ac9a42afd296b576c6453a46d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        keytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
        • Size 19.5MB
        • SHA256 1bded5e2e76c35688515eb2cbbc4b998dfe1c6554d26e14f676b49d0553a1bc4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        kinit.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
        • Size 19.5MB
        • SHA256 7ebdbabff186637da0f7813881340322273a527cb7294d0cf5e04e47a1682108
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        klist.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
        • Size 19.5MB
        • SHA256 12636bff479cf4e0ff3dab2f12bd3d5a0b250fe8853f517f0ff864ce1039f543
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ktab.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
        • Size 19.5MB
        • SHA256 206b0b99746317e0e0432e79bbac6d0dc0a3bcc9f525bf185957f3a24138c9cc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        native2ascii.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
        • Size 19.5MB
        • SHA256 29f893081eeee6ce6cd42c57d22e7b1fca383fa2dd1860bb3b15fcb63a4ef410
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        orbd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
        • Size 19.5MB
        • SHA256 607eb56f0cb483ec3334b2b8d89276c7d3d314445a1ffc1d404faaebb370a41d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
        • Size 19.5MB
        • SHA256 5f982ebc46d455c482886388a6ad297cb05d5d16ed8fb93587c4ab8c83b6ac86
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        policytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
        • Size 19.5MB
        • SHA256 41e1fcd57f6957fe6b291084da5e6d1c7d336aaba971a3e3ee678bc2bbf2266b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmic.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
        • Size 19.5MB
        • SHA256 7ab5db887aa90f6c55a6638ef46f6c8a2adccb7a9957a04e6fe056760b50882c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dotnet.exe
        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 19.6MB
        • SHA256 27b812368ec282ef890f0811f7ede91e57fddabc11c30976b949aa2f63bd9154
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 19.5MB
        • SHA256 ea463eeb431fa43f8ca0e6e0563caaa9d100bdfcc9cd4db6affbbb49ffdddedd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 19.5MB
        • SHA256 420b349ed24a110398c7d2a7f77d69211f13286da30bbc5f309c3c3e298b739d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 19.5MB
        • SHA256 93513846bd813343ea2bfc8c7fb722a2837f1dd4ab44dce51ec4f4baff673ee8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        spo0lve.exe
        • Path C:\windows\SysWOW64\drivers\spo0lve.exe
        • Size 9.7MB
        • SHA256 00b756f18d17abb989f2497297187a499c48f5c13953020f0285d0f9d73972d9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download