Overview

overview

8

Static

static

3

2026-06-04...ar.exe

windows10-2004-x64

8

2026-06-04...ar.exe

windows11-21h2-x64

8

Analysis

  • max time kernel
    149s
  • max time network
    91s
  • platform
    windows11-21h2_x64
  • resource
    win11-20260513-en
  • resource tags

    arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
  • submitted
    04/06/2026, 11:31

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-06-04_14f8cd1fcc90cc4016991f00acdfd843_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
  • Size 7.4MB
  • Sample260604-nm4ljset3r
  • SHA256 0c1ff02abe217e12bed2ddb2312b565dcb58a9c99024c1ffad00a9a2a12a529c
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
defense_evasiondiscoverypersistenceransomware

Malware Config

Signatures

  • Drops file in Drivers directory 3 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Sets desktop wallpaper using registry 2 TTPs 2 IoCs
    ransomware
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies Control Panel 4 IoCs
    defense_evasion
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-06-04_14f8cd1fcc90cc4016991f00acdfd843_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-06-04_14f8cd1fcc90cc4016991f00acdfd843_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:908
  • C:\Users\Admin\AppData\Local\Temp\2026-06-04_14f8cd1fcc90cc4016991f00acdfd843_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
    C:\Users\Admin\AppData\Local\Temp/2026-06-04_14f8cd1fcc90cc4016991f00acdfd843_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:3284

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        7z.exe
        • Path C:\Program Files\7-Zip\7z.exe
        • Size 15.3MB
        • SHA256 a451a1f4e7d2526410a99d314b7391425c0f8da5f4a0c8a6a64f95fb622687c2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        7zFM.exe
        • Path C:\Program Files\7-Zip\7zFM.exe
        • Size 15.7MB
        • SHA256 ef1c54fcc62fa3287c815c6e5158e13fcbfd28d703925dff76b2b0d65a5b25ee
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        7zG.exe
        • Path C:\Program Files\7-Zip\7zG.exe
        • Size 15.4MB
        • SHA256 2b588a4d2a6fc24e4f0b454a314d3ec7716274e816f350530628ecdf72f7d101
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        7zG.exe
        • Path C:\Program Files\7-Zip\7zG.exe
        • Size 15.4MB
        • SHA256 8cae5166c030af65bbca5bf2f1236470f214147987e121d7ce9408860a74da8b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Uninstall.exe
        • Path C:\Program Files\7-Zip\Uninstall.exe
        • Size 14.8MB
        • SHA256 7cbf9857a7d211ba176b023f4f411ccdcadab23ee18f23679d05ecea19a7f5a9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        AppVShNotify.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
        • Size 15.0MB
        • SHA256 0cda5e46ec71b4e3bd3e075a6b4d6378568b9d55f170927f6f863b833eaaf859
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        InspectorOfficeGadget.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
        • Size 14.8MB
        • SHA256 d8e378e678525576d43d359b669fc059db9e56b48650c85ec8e5b9a89c860d43
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        IntegratedOffice.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
        • Size 18.8MB
        • SHA256 46862bd2264eda2a89c053a94199694dbfe0674544919d00c5b7eb3ad21827b7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MavInject32.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
        • Size 15.1MB
        • SHA256 cbeb0384b368d423a0703e88b8567d6c2d385d6ff79b9dc4106048d3b91e88ba
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appvcleaner.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
        • Size 16.9MB
        • SHA256 e95f48e38107fbbb89184bd4cd37db7646b0f7bebd46c1998e2f8b3fb75e163c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VSTOInstaller.exe
        • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
        • Size 14.8MB
        • SHA256 aa320ed194385cd2904feb8402256c2e1786ef745f57185fdcd88bc268787da4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrmstp.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        • Size 20.8MB
        • SHA256 acca835969ffaae3b412594a6bd75f8659b1606b2a559ce95a0b05ed498af099
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_pwa_launcher.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 16.5MB
        • SHA256 bd49bfe0631e4cfb71190229e571fb7a4fe18c16158a1841f1f8fd021a3fc6fd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 17.0MB
        • SHA256 7e0b2d7b80566d9adfb3ec88b77268b705ee90c34035e2fd6945c618629a2c92
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notification_helper.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 16.4MB
        • SHA256 a6ce986b3525ad43004d8f7d5d9eec3630c9db58f1152bec02a7cd31b1f2afb0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        os_update_handler.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 16.6MB
        • SHA256 dfbb5211ae7e5129821a4520d7ab0126a78f8641ea8a05465378f2936bcf0f27
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 17.8MB
        • SHA256 ca8ae86422d72c447fca742687f2f61993d0e354ec13bfcab3f242309fd517a0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_proxy.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 16.2MB
        • SHA256 4591fffa4ebc56d05343665210ad4f84de702b2b742e96c51e6e7933f86592be
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 14.8MB
        • SHA256 c865ea9e4bef28b5201de6cacac38c662e7d8725e9eecea90919365b9b359bbf
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 14.8MB
        • SHA256 9ae68e495bc36fb88a52145ee78892f39d63c953c19b4b43b862650f2760a6a0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 14.8MB
        • SHA256 aabe0bd67a7312c9f5fe9921644ab5282fedc0b74caa14a7ec7c345a6c2c18ca
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 14.8MB
        • SHA256 f933d13f1615f35e0b51b0b2134de5b22fd40fb02b73eb8c6fa018e55af18764
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jar.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 14.8MB
        • SHA256 eb3b8982b10e2bf65b553d5a84b97a2ca14334e9d3760b08c1cff99ac2d144ff
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jarsigner.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        • Size 14.8MB
        • SHA256 f8c1d931fee111e9cb1a10661a17bfeb8a0068424a0acea2b203092646277d98
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 14.8MB
        • SHA256 8e015219d797f34d0f36f971a9e697c706ef6398603c0fd802a681373bd009ca
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
        • Size 15.0MB
        • SHA256 d1d2149725d7568ea1d55030966277998924adca34229e5d3dd46cfcf880b7f9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javac.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
        • Size 14.8MB
        • SHA256 8ee7b5ad0dd77db20c563f033df07011e56cd45315e4716de0749bf10ae009e4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javadoc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
        • Size 14.8MB
        • SHA256 d7e72f7ff1452c37c8d18f43d29fa9abe753e5ae322d1eab34556d484258ac93
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javafxpackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
        • Size 14.9MB
        • SHA256 83130fef48367ae52bb5450a40129f608d92b844dc14ca3751574a868151ccd3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
        • Size 14.8MB
        • SHA256 cafbc80e34f72b1704b57b1447a54a5a8cc9e34a7b0400497c3b6041935ab9d5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javapackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
        • Size 14.9MB
        • SHA256 c1c6887fc62edeede12a7bb4dddf00b38d33effe0c1ce388ffbb92fb8a944c0d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaw.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
        • Size 15.0MB
        • SHA256 8ce844209fb1c0e5ed2e772a7edb6021d6ced417d6efce294effc56b85f971b3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
        • Size 15.2MB
        • SHA256 fdf620fc9e8468d28173cb94fccae6bd292340b0537bfad3f44ad59b4564d5cf
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jcmd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
        • Size 14.8MB
        • SHA256 245f3215ab787d4945a0f9cb19a77ee8bb96499bd22d45ed8c2756fd2d6abef2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jconsole.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
        • Size 14.8MB
        • SHA256 a3f1723bceb7910e0f0d3ecb4e545ee57d4dbb23ab54a69245849eb99e9b92e9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdb.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
        • Size 14.8MB
        • SHA256 b11d5e1040d2c06333e4bfa10978aa906540f2bffcbb1d3ed6e013498d41412d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdeps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
        • Size 14.8MB
        • SHA256 8dc101022aca5244953ffb2f01c43b513328d1b4ed7b4eecdc5a3d18fb10cdba
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jhat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
        • Size 14.8MB
        • SHA256 b7ad899d0bc48a754618880c9799733c91b187418eab3b08f087f13b30ea7076
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jinfo.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
        • Size 14.8MB
        • SHA256 0151434eba91deedb8ba7e748c774c86fd70ba5bd05e44a211989beb29ffab0b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jjs.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
        • Size 14.8MB
        • SHA256 63102c2fe62dc327c0579959f40b1ba61419a7dc68b903c85a6d9304bbc02053
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jmap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
        • Size 14.8MB
        • SHA256 a673b1998fd2c5fa533beb64e029891302551d04f0a68e45cd998e7f6f67fcaa
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
        • Size 14.8MB
        • SHA256 facb79b7f58b9d3b7dfa0649cf37f10efd6b759c2b60599233ecb66978896ce5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jrunscript.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
        • Size 14.8MB
        • SHA256 8b58e307c10c2a616d7c6e84a9fdcf3735c5a7883b59db56dd66fec2832666d1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jsadebugd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
        • Size 14.8MB
        • SHA256 740bffa1deb2c26213ff3fdbb583ca71f09c1784b4f9ffeb57e6c5fc3da553ed
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstack.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
        • Size 14.8MB
        • SHA256 1034a76f54ac8bbc4673ec9d3de7e8a881d3fe59c2a564c1baffa73f34b2c39f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
        • Size 14.8MB
        • SHA256 897052e6c762418f7b40d170cf8d3f379978e1ba2be9fb81fb0c21fa1dcb7736
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstatd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
        • Size 14.8MB
        • SHA256 ff7cd68eeaccf295bd15bf6aec58deffe04a37a5832e38888df66bfc3e9440b8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        keytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
        • Size 14.8MB
        • SHA256 3564927f63907a17a6ac87a875239c8e4979eb08d0d4c94ee008e533ab1e6c04
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        kinit.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
        • Size 14.8MB
        • SHA256 b64a6eed647be2932e341516f71c1ec3817102b9db0f1726c2b47951a4749ce2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ktab.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
        • Size 14.8MB
        • SHA256 7b52c319ce6f878c47151a88377e1535cde60ba12e5fff8b1138b89d1a6c38d3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        native2ascii.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
        • Size 14.8MB
        • SHA256 3963f13a8c17a27ad1f55c43a189d2a7fb13884d8f30987ae7b4e4f80fb0d07b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        orbd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
        • Size 14.8MB
        • SHA256 86a3ce8f69d161b4f744ea1b466512a3cf8e2835a152e3c11fc1136ac3f6444d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
        • Size 14.8MB
        • SHA256 6e4ac2fd9002b2441a8f1fcf89ad20ed7df4cc1d110285d597339708f51ec4e2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        policytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
        • Size 14.8MB
        • SHA256 8c66edd701129b673e0d35ebef9d7f1edd99fcf24be796b04d254093df05fead
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmic.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
        • Size 14.8MB
        • SHA256 b4c8f19318847ef94c5d32346d43c4ca50a670335c67628ba11917cb803b8e80
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dotnet.exe
        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 14.9MB
        • SHA256 5b422e36274c085dbd8c6debdca3b0935185f8a713bb6c1614ebd1f64945e448
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 14.8MB
        • SHA256 27180ecaec3ce8cc5253d8bae4e72949ed341e34664f176edf38b00cfc1383ec
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 14.8MB
        • SHA256 adfb54b9f1408e3b309d0a6c37f4ad9bfb440b774865c356d9fc77ce6734347f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 14.8MB
        • SHA256 10f15d51cf928d623531b5ea52e77f3be04b8568bfd36fb072ab420735bb3c14
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        spo0lve.exe
        • Path C:\windows\SysWOW64\drivers\spo0lve.exe
        • Size 7.4MB
        • SHA256 0c1ff02abe217e12bed2ddb2312b565dcb58a9c99024c1ffad00a9a2a12a529c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download