Overview

overview

8

Static

static

3

2026-06-04...ar.exe

windows10-2004-x64

8

2026-06-04...ar.exe

windows11-21h2-x64

8

Analysis

  • max time kernel
    149s
  • max time network
    149s
  • platform
    windows11-21h2_x64
  • resource
    win11-20260513-en
  • resource tags

    arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
  • submitted
    04/06/2026, 11:41

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-06-04_53433b5dc4d2bb603a4fee507ddbf1ef_elex_emotet_glassworm_icedid_remcos_vidar.exe
  • Size 3.3MB
  • Sample260604-ntw52sdv3w
  • SHA256 1b72707b061d9fb664bf8a203a5740cb31a772947d208f5fd624df291111f39f
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
defense_evasiondiscoverypersistenceransomware

Malware Config

Signatures

  • Drops file in Drivers directory 3 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Sets desktop wallpaper using registry 2 TTPs 2 IoCs
    ransomware
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies Control Panel 4 IoCs
    defense_evasion
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-06-04_53433b5dc4d2bb603a4fee507ddbf1ef_elex_emotet_glassworm_icedid_remcos_vidar.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-06-04_53433b5dc4d2bb603a4fee507ddbf1ef_elex_emotet_glassworm_icedid_remcos_vidar.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:4776
  • C:\Users\Admin\AppData\Local\Temp\2026-06-04_53433b5dc4d2bb603a4fee507ddbf1ef_elex_emotet_glassworm_icedid_remcos_vidar.exe
    C:\Users\Admin\AppData\Local\Temp/2026-06-04_53433b5dc4d2bb603a4fee507ddbf1ef_elex_emotet_glassworm_icedid_remcos_vidar.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:2332

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        7z.exe
        • Path C:\Program Files\7-Zip\7z.exe
        • Size 3.9MB
        • SHA256 e1a3247d123b3b3d73ae5fa2dfa1f832f0bcf96bfd5bded58cdaeea38df665d8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        7zFM.exe
        • Path C:\Program Files\7-Zip\7zFM.exe
        • Size 4.3MB
        • SHA256 3947b81a2f22ceb5b13e294debfca172d9a006638063b833e836c43928091833
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        7zG.exe
        • Path C:\Program Files\7-Zip\7zG.exe
        • Size 4.0MB
        • SHA256 c6cf8f5cee149125c5cf1eae158a405507a5a9ca4d72b1d2b524b133424527c1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Uninstall.exe
        • Path C:\Program Files\7-Zip\Uninstall.exe
        • Size 6.7MB
        • SHA256 585e44e7bc5fcb7fa4c706273adb332893d05522d6caa4af9273bf2b9e3524c1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        AppVShNotify.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
        • Size 7.0MB
        • SHA256 bb1dc7bc303d8cebe2314e2ba5f4fca5eb5ea55266b6679d55f0b9d16615782f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        InspectorOfficeGadget.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
        • Size 6.7MB
        • SHA256 8434fe989f1cec2e65e1da13376210fd62ebf66e6d3455ca0194929a407d0ff0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MavInject32.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
        • Size 7.0MB
        • SHA256 bf9079f42bbdcc2fe4af783fb3894ac50a2e94bee774905ca10803273efbebba
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appvcleaner.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
        • Size 5.5MB
        • SHA256 f7ff5e0ad48d8a469d8d388134b04ee4b30602a947a7d479ed83767b1cf8f9ac
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        setup.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
        • Size 12.7MB
        • SHA256 b2348602ca7d3a4b73037145d0a869c91125d50e788a31dfc92c3b06f159a58a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_pwa_launcher.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 8.4MB
        • SHA256 11bc6f75c3c9c284217ce240fb647ea7531250b3099ef866e15f48be4d419b6b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevated_tracing_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 10.1MB
        • SHA256 2f2dca8b1b848302eefd1c6c8344ef60bb4e9009ac2d2582f2d6a0066a905b85
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 8.9MB
        • SHA256 09223bc7224bb5125725c3603a2f77d9e8bdc8d0c1d01d02ade182ad2e7644f9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notification_helper.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 8.3MB
        • SHA256 ba3f61c61348c48c1c2773021db978181f4b3470bc24274f3dedccbc492ab2de
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        os_update_handler.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 8.5MB
        • SHA256 f6aa93f8ff0a113ded6c6693c65dec143810d15a83e4ff1529addf40326242fa
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 9.7MB
        • SHA256 5a7734ba2386258f59c4bc130e1840660d79da10803fb9c13c101eeb56d3a5d3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_proxy.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 4.8MB
        • SHA256 ec2e98ae3cde2d2aceb255d01f886d9c25a321037547d57c19addaa873f8e0b7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ImportAssert.asp
        • Path C:\Program Files\ImportAssert.asp
        • Size 6.9MB
        • SHA256 fbacceea2d628b224b3edfa336faf7860a2e45a70d3a1ead4872530fc2417b0a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 6.7MB
        • SHA256 f4e54926d44a40553ff820ccd044c02de0cfcb8dd70a0037a82d6c63ec23b52d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 6.7MB
        • SHA256 5ae48946a413ee95a30ec1ad681ca528f9434fa94dc44f8ec86fb6b72acf5d61
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 6.7MB
        • SHA256 38356594a3d5b86f51211e31ec22583a073696fc9068d816983eab4cf071ead7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 6.7MB
        • SHA256 5c7bcfcb627f3243ff10a4af80065d1056f84fb9be2d0e2471bfc1c0896286fb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jar.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 6.7MB
        • SHA256 a6d815171da891a7db323be9f279f15fa90fca00576789dbc97c98f801f62ab4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jarsigner.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        • Size 6.7MB
        • SHA256 7e14907a9543c236fd957ddfdc22a3fff5174700ed0504d6f029de13c7cdc06b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 6.7MB
        • SHA256 b1c22ff3d4d968eeb1efdf5712dca1f2e00fe55672f8ae0891257598a25d7e6a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
        • Size 7.0MB
        • SHA256 561ab9199b4c9f9add9ade4484b420f3d280a6498bd47e72495aefebf90bb469
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javac.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
        • Size 6.7MB
        • SHA256 be42904900d697f86b9bc4838e1e921e9e4beaac759d3c68ad248b19807a7753
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javadoc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
        • Size 6.7MB
        • SHA256 363fec22684642b9b737ddeb63fff49c76787facc457325c43c25d19a66695dd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javafxpackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
        • Size 6.8MB
        • SHA256 fe168fbb675a65e89f10b7d3d5d642e31af6b5a12aec0cf2991842530abca6d2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javah.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
        • Size 6.7MB
        • SHA256 13ecf51b3e6f2341bd1f34b5b7f31dbc3e081f077f992834ecbf875ca84d5d6d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
        • Size 6.7MB
        • SHA256 3c698c05295d10ab3f8449852c181225c895db709f0c1928c9888a7295022f7f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javapackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
        • Size 6.8MB
        • SHA256 11d23b556573a536de0586ab856d4aa4116017e72a9cda4cb039332f0dd27b93
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaw.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
        • Size 7.0MB
        • SHA256 e168700e2f8d9ef94312b9654a1b317727bd34019f3b390cc3e04fc726a06539
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
        • Size 7.1MB
        • SHA256 4e2793c72662cdee751afa1f1be80a6791259506f8279e6852fda77ff6080e36
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jcmd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
        • Size 6.7MB
        • SHA256 d9dbfdd063e23ba31c76204113a96b0eb5b0dec9eb89fd43753ef99c19881c32
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jconsole.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
        • Size 6.7MB
        • SHA256 adb47aa12ee33eeb1dd050dea00ec477468c8c1d9cfc06727c23512555c49735
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdb.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
        • Size 6.7MB
        • SHA256 999fea345b6d5d3bb7d223cf0ba0cfa3ec04ebad8bad77deb9d28424d5ed1be4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdeps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
        • Size 6.7MB
        • SHA256 a9fcc971484f20add40c5804d8a17a24fefef0a6a4e02299037845b817b90490
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jhat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
        • Size 6.7MB
        • SHA256 ead115e92353948ae5c2af327529d498ddb216dec844f696c713e8e89b607e89
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jinfo.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
        • Size 6.7MB
        • SHA256 b4b3051cdaaf70fcd0d14a3f2aeabb83e56515c8d565c5a508d31df4b6d7a314
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jjs.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
        • Size 6.7MB
        • SHA256 ae10ab76aae70a18283e2815a84b846ed4b0c3e53f1c50b7539dff40d77593ff
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jmap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
        • Size 6.7MB
        • SHA256 5ba088a35af5f062c7140fe16cd26164dc5efd72637829f4a13796c3a9b42f7c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
        • Size 6.7MB
        • SHA256 d22695e919088d2da86e1b0848d7cb392d5e360d8464c0e014b26ce4a12e2f06
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jrunscript.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
        • Size 6.7MB
        • SHA256 8c8985ef6409cec875192a64f87e93740ca4a8e69bd7e73bf87d8e2ce6c57e5c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jsadebugd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
        • Size 6.7MB
        • SHA256 c0ed83720ff83b0aaf3f6ed1c7c057fad49e221dc6083ed76203c1ca5b4406b9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstack.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
        • Size 6.7MB
        • SHA256 9ada9fc8f37f5a52c3c7ac632e562c070ad5a87855d438b8c1e58354c5cae06f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
        • Size 6.7MB
        • SHA256 71527a2ea65578bb13e5fc189d3c4bbf13bec7ec905f2b9da1b8118d1feb9b96
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstatd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
        • Size 6.7MB
        • SHA256 ea825632cad60d51519cd2eacefdb051e52a836ceae4f9b295a9703d5b50b19f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        keytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
        • Size 6.7MB
        • SHA256 aaa1e9ff42393082ed1fd91cc2fa6969d8b8839cc1e11123cac70a99013b4ff7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        kinit.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
        • Size 6.7MB
        • SHA256 161ff0a44232ecf43098347d77e927b9ca4a594c0361fce4738576c3f44e9fea
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        klist.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
        • Size 6.7MB
        • SHA256 b0bcd2f9654c362724afe4f2052920aa6001beea7ce06c7546daad35b198aa8f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ktab.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
        • Size 6.7MB
        • SHA256 5c28549e00ab9bdd587f855b3c0e29758b9613637068875090a13783b10478a1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        native2ascii.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
        • Size 6.7MB
        • SHA256 7a1381e75804dc41c4258873f1c1f4b63e56985f28aebb6a682f7813dc5fc719
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        orbd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
        • Size 6.7MB
        • SHA256 df481dee26584cf51bbebbcc8aa55538e69421631aeb45e7c2eb1535752d0665
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
        • Size 6.7MB
        • SHA256 62cea77042c3bf6b6f54568e738ef8faa0ed03c85cc79fa3ae5cf0fcd96d1ef6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        policytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
        • Size 6.7MB
        • SHA256 df4c80e0db2bbee9bd5da48b073cfdff86b9d2be5930f33d1be95c6bdb2c42ca
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmic.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
        • Size 6.7MB
        • SHA256 08460c598a2faf4f08f3e16efbfd8faf0d6fafdd9aa1f63e5ef73656fedfd962
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmid.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
        • Size 6.7MB
        • SHA256 ab54616db72653a1ab675a4af0aa96bb7096d2926684be36f13d8cfd678caf8d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmiregistry.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
        • Size 6.7MB
        • SHA256 1a9d96c421c8d91a539e74668e86f862f25d5332c3f74200e0e8291b818cfe10
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dotnet.exe
        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 3.5MB
        • SHA256 ca2a1cd304a3a7a1df083c770036edd6ca27e5366956a05e98d8771c2e6d0059
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 6.7MB
        • SHA256 55589045e393bf98707752e88d73c1d77dc80044141df3380f863626fa9edf1d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 6.7MB
        • SHA256 c94297b57e4aec857fb2a21e7bed1a626fb9bca3d6bb7f986f3d65023d803429
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 6.7MB
        • SHA256 09e34204d08e6e848fa7bd66392bf2f68301fab2097c422be61cbef415046ee1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        spo0lve.exe
        • Path C:\windows\SysWOW64\drivers\spo0lve.exe
        • Size 3.3MB
        • SHA256 1b72707b061d9fb664bf8a203a5740cb31a772947d208f5fd624df291111f39f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download