Overview

overview

8

Static

static

3

2026-06-04...ar.exe

windows10-2004-x64

8

2026-06-04...ar.exe

windows11-21h2-x64

8

Analysis

  • max time kernel
    148s
  • platform
    windows11-21h2_x64
  • resource
    win11-20260513-en
  • resource tags

    arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
  • submitted
    04/06/2026, 15:38

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-06-04_82272b654bd32f55f9e11f3de3a7fa80_cobalt-strike_elex_emotet_icedid_remcos_vidar.exe
  • Size 6.2MB
  • Sample260604-s3fa4shz21
  • SHA256 d48499a7cd4b60514a08f4f426f946e42848b9851b25d079264599c16762b188
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
defense_evasiondiscoverypersistenceransomware

Malware Config

Signatures

  • Drops file in Drivers directory 3 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Sets desktop wallpaper using registry 2 TTPs 2 IoCs
    ransomware
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies Control Panel 4 IoCs
    defense_evasion
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-06-04_82272b654bd32f55f9e11f3de3a7fa80_cobalt-strike_elex_emotet_icedid_remcos_vidar.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-06-04_82272b654bd32f55f9e11f3de3a7fa80_cobalt-strike_elex_emotet_icedid_remcos_vidar.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:5180
  • C:\Users\Admin\AppData\Local\Temp\2026-06-04_82272b654bd32f55f9e11f3de3a7fa80_cobalt-strike_elex_emotet_icedid_remcos_vidar.exe
    C:\Users\Admin\AppData\Local\Temp/2026-06-04_82272b654bd32f55f9e11f3de3a7fa80_cobalt-strike_elex_emotet_icedid_remcos_vidar.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:1256

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        7z.exe
        • Path C:\Program Files\7-Zip\7z.exe
        • Size 6.7MB
        • SHA256 68ce99ef3a965d268573573b873b1cecc70b343452e9135ed20a80964c925bcf
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        7zFM.exe
        • Path C:\Program Files\7-Zip\7zFM.exe
        • Size 7.1MB
        • SHA256 990e6307ebd453ab04118246700d8b9148e637625f4a15254526959c6c797c82
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        7zG.exe
        • Path C:\Program Files\7-Zip\7zG.exe
        • Size 6.9MB
        • SHA256 870469a37c222e4d4aa5da643112ac91d38e7b985b320b18307bca5fb3df7861
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Uninstall.exe
        • Path C:\Program Files\7-Zip\Uninstall.exe
        • Size 6.2MB
        • SHA256 f9a808f864a69a7a1888fcdd34e3898214be4c4f9fe126f4b31030216140cc94
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        AppVShNotify.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
        • Size 12.7MB
        • SHA256 81a7d1f110cf9f16fdc2c88bafdb3723be918b04fe5823af9716e6b481069859
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        InspectorOfficeGadget.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
        • Size 12.4MB
        • SHA256 5f8a22ccce4aa8652fc7c122226958bc62ff41a4944340861c17774a8d399958
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        IntegratedOffice.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
        • Size 16.5MB
        • SHA256 2a8c2c8b25cc5e8675488b4b5eed757389a52466265240c4549afc5a9942810c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MavInject32.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
        • Size 12.7MB
        • SHA256 eb306ae33f3898b655993674b98043dd6fcfe2ebfccd1070371f3d49e1dce853
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appvcleaner.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
        • Size 14.5MB
        • SHA256 7a08fb6564ddab4b5606e440e69b0dd886e9c8a6708dbc895a3d1268eeb4c935
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VSTOInstaller.exe
        • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
        • Size 12.5MB
        • SHA256 b3b3b4c02d99f24cd5b91ee4f7a0ee2d5164e3f35aa662a6ecebcdf52a3211d2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrmstp.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        • Size 18.4MB
        • SHA256 c48e06bd9e354ec54c3fd1892eaaea36751243a7bf1b4314e951cd263e6555fa
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_pwa_launcher.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 14.1MB
        • SHA256 d3b2cd14785417a41f868a489d6e62aec496ce1d4a0d2fa2aefba95876ec6715
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevated_tracing_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 15.8MB
        • SHA256 0835bc0ce93455b8478b49afab0f51b361b8384788c081fa960f41d78a431818
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 14.6MB
        • SHA256 7f0da7349d61ab7f92d8c7c9d38410ec56b0c42f1405e764da75dfe4ba217165
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notification_helper.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 14.0MB
        • SHA256 5f24a66976a9f2b477a4f97f2d6ec4061feee2e0300eb39c9c55f8ddf075be86
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        os_update_handler.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 14.2MB
        • SHA256 d31016301008c9a221e8984433143d10187f997e5d37aed211cc353fde620a66
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 15.4MB
        • SHA256 78a20b3dcea30b18a9cb8e9ffd5d735a6be7f122a22cb85701b5f62842b003c2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_proxy.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 13.8MB
        • SHA256 4964a0ff2aa59a93bdf0ea01b3a75f3c413931bd6cf1851cc89ed5e427d3f94d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 12.4MB
        • SHA256 20c7e1469f3a1573642fa5c9a4939925778ce433a7a0dbf03789a4f72db72430
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 12.4MB
        • SHA256 c0796c2086120db328f7d04bcf1d4e76bf2f05c5f248d6adb2f3aeee4bfdc6c9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 12.4MB
        • SHA256 f968d5c26f3a6c4c1ffab1f23831aace07af4c117a0a49879b1cc03151e74748
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 12.4MB
        • SHA256 eaa2e15f873cc91b2885f4bc1a17bf2e659aa5a04ce38d1fff0d02a9354d4b12
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jar.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 12.4MB
        • SHA256 33f25806d0d3da628fae029a975afb8abd8634d7edb220991124ba8fa82795af
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jarsigner.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        • Size 12.4MB
        • SHA256 78a9c0128acb93712ef55f1fea185dc55673f3cff20db3b6bfe2cb3d5daed069
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 12.4MB
        • SHA256 e5d2d9233f142d1a99e4edddb9188c6515c96e3d868a0c156ff580c11d65ed0c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
        • Size 12.7MB
        • SHA256 48c59bb004ae4da544b3be064671e34deff823627673569a017d7451c1c18fb5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javac.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
        • Size 12.4MB
        • SHA256 4c2ddde2d38fbd91169c2fa795c326ccfb31f69f1a50e7d1b52676677acad10d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javadoc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
        • Size 12.4MB
        • SHA256 3e4f2f116dffe873cb3b3ebec21b9c00b2af54790f1c73765f11ca60254d2f45
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javafxpackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
        • Size 12.5MB
        • SHA256 4bdfb405ec870e9a8fdabfd8168847c2a55d91ceacfd8cc4455c5c826082b9eb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javah.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
        • Size 12.4MB
        • SHA256 bdc57ddb9c2f4857cd686df442efaa1492f58950b3e982a7ae1f6ed4de4edfdb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
        • Size 12.4MB
        • SHA256 b8718dd86e71c35de4ad140aaa32452de8a25c666f9446ef71a0ec6c3ddff327
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javapackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
        • Size 12.5MB
        • SHA256 abc7a9f1b781fef9c51c04c47289a140b1ec5fcd0d4b9b0f52b6e9a8a8ddfb6c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaw.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
        • Size 12.7MB
        • SHA256 12ad4fdfe8cbfe4c43c24281f71ed47a18588acb83646ab0db1e24dd04e2db0f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
        • Size 12.8MB
        • SHA256 a75987874a1dd8fa465b3869cc07408935081e84eda3f06f6d10e6aa6ac038fd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jcmd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
        • Size 12.4MB
        • SHA256 e24f425b178f589c30c2ede180a7488f09f9b9180d600ec9c913dc8a7349ec14
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jconsole.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
        • Size 12.4MB
        • SHA256 07f87cb5202de6449b64651fd51a62dc90e27fb34cf8b42ab823d9a53c05c508
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdb.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
        • Size 12.4MB
        • SHA256 b71d77885bbf9ecd1e61baeea81d1d2a3db4d283bc4e5a72a4a46e6ffc9913b3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdeps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
        • Size 12.4MB
        • SHA256 cae1d2aee8195842697d0ee7394fd3f632368adeff6add4d547b04db0f31a1d0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jhat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
        • Size 12.4MB
        • SHA256 01ef6827a868e12880c8c4ee2fef41a8d7df9c74eea137e793f3236aa22e254c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jinfo.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
        • Size 12.4MB
        • SHA256 30d22207bbd47905e6caa8bdbd48d2c3911f810d078aabf354eee44cee5628eb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jjs.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
        • Size 12.4MB
        • SHA256 8502c001efe5e13f2ebfb0c7ff5a77fa996a966724fc128822438106d83af292
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jmap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
        • Size 12.4MB
        • SHA256 39b79899540b5f003555e3bf00007388cddd18afb682ec0c24e21cd28a96f1aa
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
        • Size 12.4MB
        • SHA256 bb62d867250e3a146d58fb27531e58d391b2519fd8b384479f8b1e19fbaee099
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jrunscript.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
        • Size 12.4MB
        • SHA256 b75ebb2a94f8dba810f1acaf756b8d08e6763ee80b779eede05a1e9971b08936
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstack.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
        • Size 12.4MB
        • SHA256 64402789970206f7e40e2bcc710e3d19aeb24769c13aeb1528c7571b1e480146
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
        • Size 12.4MB
        • SHA256 74e525618ced28e19b08dff6c6fbcb21b1ca48a40aa93e096032af51bb075e91
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstatd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
        • Size 12.4MB
        • SHA256 1315feb590d0447c56865afa44cae5073edbac33b9e462cf443353cbfce4b63c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        keytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
        • Size 12.4MB
        • SHA256 be0a94f924183e88cd926c2ee438c2fe330e2f7a9bb0438a0ef25218e2165d78
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        kinit.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
        • Size 12.4MB
        • SHA256 95e6c5db11a001f3cb3d112eade34238678a7a6ed05dff7325e6b07475452cff
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        klist.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
        • Size 12.4MB
        • SHA256 d02c81a5371ccb4a96175f7d16221200a8433b7ba623d0e2e7e8c0f13574be59
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ktab.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
        • Size 12.4MB
        • SHA256 2ccb9b269a7844881e8c854ba248db2a8100cc0280c34d96808c2f2defcc021d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        native2ascii.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
        • Size 12.4MB
        • SHA256 5d0b6a81bdc8aa61eda6187286dbce5086abf780df65bc70203d4565a291844d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        orbd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
        • Size 12.4MB
        • SHA256 c1f464554701549758f39d3fa4759b9c3383828f9e1dcbec040ecb077e61d507
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
        • Size 12.4MB
        • SHA256 1e16ea4e990671fbe20d4cce40a7465138775b56e7aca9740b96898b35ab5aaa
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        policytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
        • Size 12.4MB
        • SHA256 373f2f3af0d097ba8c1d1f9f3d9dc5271ff20d3c8b24e3e1ab42eefe30ef6bd5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmic.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
        • Size 12.4MB
        • SHA256 1b66f5640622c8d3b495a9e57eeee3814d161b2d2c4551e41e216b5d7be29707
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmid.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
        • Size 12.4MB
        • SHA256 298ff8ddb3893e04633ceb1825b08cac80b22b2702d11faa892b62ceb1aa507f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dotnet.exe
        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 12.5MB
        • SHA256 4d298e6b880121f5928ac6bf0df9ccaa132ac61b55a45db01963f0a9002504ff
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 12.4MB
        • SHA256 dc954b8f02b585579e74b76d143b62781803d82829dcd82819c3579b82e9066a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 6.3MB
        • SHA256 4f8e73150109f9f69b178db7b6e9bb6c9a91a03e1080c64d6e76df1ba3968fb9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 12.4MB
        • SHA256 64ad61a5a9252373901ad2be47d3c1f6acc1a752e48f45beb4cf0566ff80da62
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        spo0lve.exe
        • Path C:\windows\SysWOW64\drivers\spo0lve.exe
        • Size 6.2MB
        • SHA256 d48499a7cd4b60514a08f4f426f946e42848b9851b25d079264599c16762b188
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download