Overview

overview

8

Static

static

3

2026-06-02...ar.exe

windows10-2004-x64

8

2026-06-02...ar.exe

windows11-21h2-x64

8

Analysis

  • max time kernel
    149s
  • max time network
    151s
  • platform
    windows11-21h2_x64
  • resource
    win11-20260513-en
  • resource tags

    arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
  • submitted
    02/06/2026, 11:33

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-06-02_22d08ae9da734d2a2559048f988299fe_cobalt-strike_elex_emotet_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe
  • Size 15.5MB
  • Sample260602-nn7dtsc13m
  • SHA256 19d1122c736d1f9ca914dca706e638d9ce2c326875cd278649dbb12479bbaa56
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
defense_evasiondiscoverypersistenceransomware

Malware Config

Signatures

  • Drops file in Drivers directory 3 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Sets desktop wallpaper using registry 2 TTPs 2 IoCs
    ransomware
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies Control Panel 4 IoCs
    defense_evasion
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-06-02_22d08ae9da734d2a2559048f988299fe_cobalt-strike_elex_emotet_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-06-02_22d08ae9da734d2a2559048f988299fe_cobalt-strike_elex_emotet_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:2480
  • C:\Users\Admin\AppData\Local\Temp\2026-06-02_22d08ae9da734d2a2559048f988299fe_cobalt-strike_elex_emotet_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe
    C:\Users\Admin\AppData\Local\Temp/2026-06-02_22d08ae9da734d2a2559048f988299fe_cobalt-strike_elex_emotet_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:4428

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        7zG.exe
        • Path C:\Program Files\7-Zip\7zG.exe
        • Size 16.1MB
        • SHA256 dba808e79a2498de5ce6f5def87bf96f4929110a7eac398cdfa551e52397c9ba
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        IntegratedOffice.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
        • Size 19.6MB
        • SHA256 b49e8867d52a43de6758b2c81e6b7f2f814c42faeb9153f3b9b47cb362bc71ee
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MavInject32.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
        • Size 15.8MB
        • SHA256 f2895c4c2c9990bc0937ffc0b6ddbd619810cae3102bea38e34ae3f6fe2cd0ce
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VSTOInstaller.exe
        • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
        • Size 31.0MB
        • SHA256 25a9fcb1a5c11b7dfef42f9059193c4d5e2c036f211cd367fa9486d5abdc51d3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrmstp.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        • Size 37.0MB
        • SHA256 73dd963628d436384a543b6982024fd3f1247c1c7fcf1c4e17c08e67ab534227
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_pwa_launcher.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 32.6MB
        • SHA256 d0296ae1cbf0e8f207acad529aea37ab7444b0ab7b1c385cd23af93bcc9ce046
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevated_tracing_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 34.4MB
        • SHA256 03ea630c82bc9d039c56a995a443f526bfaf4d46da2c4eef15edd08baa034be0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notification_helper.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 32.5MB
        • SHA256 b17fde32c1676c82dbc7394cb95224a01031ffb82626a751c71a143e6e8060a0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        os_update_handler.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 32.8MB
        • SHA256 5a62b867bd5d1c7343edfdb6b185765b2b684635105dd5a04006eab1359a5e14
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 34.0MB
        • SHA256 97d94a925a2ab13e696d39802ca975ee914c774a3a9a477addb9d799a640f400
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_proxy.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 32.3MB
        • SHA256 e01ef3f26540deddbd19c1bddb88308a4aba53b8382b3642be37d434990d69f4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 64KB
        • SHA256 79a0b1f3b0958e830806c9254c2ba2af079ac99713004febcc3610200c9f504e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jar.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 30.9MB
        • SHA256 f83bfe6bb8876ceabe5dd50ad358b4dc3d197ef93f235f0cb0754bcff89ce268
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jarsigner.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        • Size 30.9MB
        • SHA256 b41b8b77db73eccbe824ad8db75ee97ba1ef9b01a04a7ace9f88434bf161af78
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 30.9MB
        • SHA256 f48eb5d632e08061c04462b8bdd89c6a47314e69eda15ac2c56a674811df9711
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javac.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
        • Size 30.9MB
        • SHA256 02279ce6b075af0f4b097075ce9038cc7ea7f107dd3e76547ff9df2a525dd1b3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javadoc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
        • Size 30.9MB
        • SHA256 f04a1eca2bee6516b874bed75cc24a77790c25affe8912c333b10fdc654a697c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javafxpackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
        • Size 31.1MB
        • SHA256 af225bc81dd607118257ac0a2e50ea05eb10bcd31b5e4da51053f455e7ac82ec
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javah.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
        • Size 30.9MB
        • SHA256 7a81dfc483650152bf2b6ea34aef852800d380106105c6b7349a62fc76b081c2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
        • Size 30.9MB
        • SHA256 73398b5b59b59034dec135f6e9f114aea9aa9d60456f30106c6e9309174c7313
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javapackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
        • Size 31.1MB
        • SHA256 d2139a6928bb0005224d321a86f24b463b7d8e2b720259820de1a49ff7d06e09
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jcmd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
        • Size 30.9MB
        • SHA256 66f46d379889c66d27202af2204530b10c9da77b54796ea51e6cce6ef69ba96f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jconsole.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
        • Size 30.9MB
        • SHA256 39f56b74caaacfe72a9d864297fedd8625c1e211156c9dab5786abf71474f0ce
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdb.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
        • Size 30.9MB
        • SHA256 46f169f81c5aa86a28295b323abded6f94e9ccf64517fc6eb2443d09f06a1dc3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdeps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
        • Size 30.9MB
        • SHA256 18a3dcfc074b1ea81e1a810aaffc33b736e4f350c3de9fc021d876bfcb3dbaa1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jhat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
        • Size 30.9MB
        • SHA256 d18031c87d68644467a3c245e9b197e27a8aab9c0dc82f42ee3e0ae42b395784
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jinfo.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
        • Size 30.9MB
        • SHA256 24bd90763c71bc64ff37c2a1241c51d7f084387824eab47448d532db61bbba00
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jjs.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
        • Size 30.9MB
        • SHA256 4fc34036ddbe5cd62c137a4233920d0589c55bf0bee07d37dfa18c8a5be5cb0d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jmap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
        • Size 30.9MB
        • SHA256 de305ed6ba07eadf593674413b1698ff6b274246fd0e1068bdb4423f38a65911
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
        • Size 30.9MB
        • SHA256 fa2d21b331e68d4ece5283d6ee569759af578cb8f47103884d37f8e211914870
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jrunscript.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
        • Size 30.9MB
        • SHA256 f7c46d932dcc34be3183dfb02a352283a8a7c85cf35d7c2d3c510ddf7cec3ef0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jsadebugd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
        • Size 30.9MB
        • SHA256 867e3c9cf66b0c441fe7a50adbc90cdb1df011629ecfeff2171faff4682c65e7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstack.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
        • Size 30.9MB
        • SHA256 83403eecc00dbd0b682e6520486d462125b736391efbb0a7d5aa062d5cb81469
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
        • Size 30.9MB
        • SHA256 2063f1e2848a6d2cb994e27f25fb61436bd330b23a077dab18a6e151c4fc23be
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstatd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
        • Size 30.9MB
        • SHA256 ffd455f29593b519402fb3128f90dd6c278d02e2566601c2771ba48b59d04f40
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        keytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
        • Size 30.9MB
        • SHA256 771913cabbe53837fbd019f2e233a798add68bf53643dbe8ff1294ca3174484c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        kinit.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
        • Size 30.9MB
        • SHA256 72e1933acf6a922fac4644f89a5fa146b3ac80f92267a2ac1b1c4777af709568
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        klist.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
        • Size 30.9MB
        • SHA256 424b1d310e51b5560204ca8dd89a9c438b942308e55860f9d46ea3e80d2a48f8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ktab.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
        • Size 30.9MB
        • SHA256 1e821a981f3c40f026826e9b7701ef5e5050f7fa93ecdf599d6a2c4bf6f9aa9e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        native2ascii.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
        • Size 30.9MB
        • SHA256 f7b3868c0cc7084e3ab93ffa764def5e607d246a1b4b737f4046a32eaaa01c79
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        orbd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
        • Size 30.9MB
        • SHA256 d62069458b1bc10d1e2ffd91fa8b93fcc353ade14aa16da2f342ad15ddd8cda9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
        • Size 30.9MB
        • SHA256 0f2b3ac31c6e09d06ad6128aa402ddbd9026e671b356da46ae74623d220cec13
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        policytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
        • Size 30.9MB
        • SHA256 a4c57a17b6b80250f11e8309fd72d723b3bfb9e060b4354cef764ce146f5ff6b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmic.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
        • Size 30.9MB
        • SHA256 a0fd35e4f81f790976d1402d30dd369e24a4de3797d0a89de95c430180190ada
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmid.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
        • Size 30.9MB
        • SHA256 70db4c1c83cb4213f23a85c8066d96b299343ec41fbac0c22a5a5d51805fcdef
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmiregistry.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
        • Size 30.9MB
        • SHA256 f35eea6025199e3367d9d819058c19e7d76deb97ce40b81d780381e73d2c77e3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        schemagen.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
        • Size 30.9MB
        • SHA256 02d7e7c06aa9ef4c4d0bf0b592d1732b43f0ebec2a263a3b4f78ce423ec70e39
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        serialver.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
        • Size 30.9MB
        • SHA256 e92483f3986ef1f9ef7915c9cdc8901de49ee572c44ce7b75159c7554599d369
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        servertool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
        • Size 30.9MB
        • SHA256 8c379d64a0b0891f791d9201ddcd2a73dc8e53815d751795e52fa7d887fa5c1a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        tnameserv.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
        • Size 30.9MB
        • SHA256 64f7e752602c26efb8d95e6eea24a76c53e294155767aa3fcd7094988ea6149e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        unpack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\unpack200.exe
        • Size 31.1MB
        • SHA256 3429c89d0ac77f4ea4210471047994ca1f2cad4585f4596e6badc3ec3e46dcae
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        wsgen.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
        • Size 30.9MB
        • SHA256 f24a0b9948035e01d3e7b60591bc6e31681c1b3dd73a9f8ab957cde8e7c14d33
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dotnet.exe
        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 31.0MB
        • SHA256 2187b3c0fa89d098d3b89210f82f299b7dc8971938ebcb0d327d43a1b28358f9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 31.0MB
        • SHA256 e4c00259d2c26c1187dc6ea03717bc8336ae77b7391465c48c04a1c4f82380ed
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 31.0MB
        • SHA256 52c9e9085e36ddb5cb5d7ac253f9a4fd8ea24baf5e786c225f540d0c06446916
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 31.0MB
        • SHA256 0589558e306606d8a3fba9635176c68169d2c3864baf577eecc9a32506efab43
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        spo0lve.exe
        • Path C:\windows\SysWOW64\drivers\spo0lve.exe
        • Size 15.5MB
        • SHA256 19d1122c736d1f9ca914dca706e638d9ce2c326875cd278649dbb12479bbaa56
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download