Overview

overview

8

Static

static

3

2026-06-04...ar.exe

windows10-2004-x64

8

2026-06-04...ar.exe

windows11-21h2-x64

8

Analysis

  • max time kernel
    148s
  • max time network
    150s
  • platform
    windows11-21h2_x64
  • resource
    win11-20260513-en
  • resource tags

    arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
  • submitted
    04/06/2026, 16:29

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-06-04_f41b089e7d4794450dd5fa06241f8a71_cobalt-strike_elex_emotet_glassworm_icedid_remcos_vidar.exe
  • Size 8.4MB
  • Sample260604-tzjpssaz4w
  • SHA256 b0a29e6303fd208e0d2fd1d09024ab68262223a069181ee1d27e20a6b0e52413
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
defense_evasiondiscoverypersistenceransomware

Malware Config

Signatures

  • Drops file in Drivers directory 3 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Sets desktop wallpaper using registry 2 TTPs 2 IoCs
    ransomware
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies Control Panel 4 IoCs
    defense_evasion
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-06-04_f41b089e7d4794450dd5fa06241f8a71_cobalt-strike_elex_emotet_glassworm_icedid_remcos_vidar.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-06-04_f41b089e7d4794450dd5fa06241f8a71_cobalt-strike_elex_emotet_glassworm_icedid_remcos_vidar.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:2144
  • C:\Users\Admin\AppData\Local\Temp\2026-06-04_f41b089e7d4794450dd5fa06241f8a71_cobalt-strike_elex_emotet_glassworm_icedid_remcos_vidar.exe
    C:\Users\Admin\AppData\Local\Temp/2026-06-04_f41b089e7d4794450dd5fa06241f8a71_cobalt-strike_elex_emotet_glassworm_icedid_remcos_vidar.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:4772

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        7z.exe
        • Path C:\Program Files\7-Zip\7z.exe
        • Size 17.3MB
        • SHA256 51ffd96ef10e6d3d95d0e82a44259a03f7ed50cc0dce7f909f18de6a8bf7bf12
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        7zFM.exe
        • Path C:\Program Files\7-Zip\7zFM.exe
        • Size 17.7MB
        • SHA256 8f41e687b05f89ba4487109d82e92babeb16eb42c2a178df09d682445a642804
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        7zG.exe
        • Path C:\Program Files\7-Zip\7zG.exe
        • Size 17.5MB
        • SHA256 c5b2ff9ab651ccbbcc83889941dd3eefc59a69b5517102130c375ff06e355dfb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        7zG.exe
        • Path C:\Program Files\7-Zip\7zG.exe
        • Size 17.5MB
        • SHA256 10a0e61523206a37bf3566c1c5f93d9dc7b768e1f2c985add27c0be43bc210e7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Uninstall.exe
        • Path C:\Program Files\7-Zip\Uninstall.exe
        • Size 16.8MB
        • SHA256 5914da7f02a7bd2d30e5d93f4f51732c5d4f07c850dba72571c9e3bdc87948c0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        AppVShNotify.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
        • Size 17.1MB
        • SHA256 f9a1fe89a5da9886b0537aec4412c98e8909a31918529d001a8af68bc9817cf4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        InspectorOfficeGadget.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
        • Size 16.8MB
        • SHA256 a31650c059f35d159e651aa7ac9a9a5fbf930fc916d27dffb7b1b49548141133
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        IntegratedOffice.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
        • Size 20.9MB
        • SHA256 5ce33e9ab982e970efdf2c30280d6707bfa4453f23d00c9038dcfdb2f0abb25c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MavInject32.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
        • Size 17.1MB
        • SHA256 ee3a43f85603468d79280b03e46801b825b6e2f74d1f63c7e6fe6e6cfc9140b4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        OfficeC2RClient.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
        • Size 40.3MB
        • SHA256 7cee3975eadfec6ff6b69199b51cb1c488ebeabd931289b2ca7662b3e74ccb67
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appvcleaner.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
        • Size 18.9MB
        • SHA256 bfa0e7c124d5dbe7c0dae3f802e119977abffc89569960b6001c0794696e67dc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VSTOInstaller.exe
        • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
        • Size 16.9MB
        • SHA256 3a16d1180a2f206ee9f5ee6ea952c37ea067d6f79bc1e7e39be1a40f0e8e45d1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        DisconnectOut.asp
        • Path C:\Program Files\DisconnectOut.asp
        • Size 17.2MB
        • SHA256 87bdbace59e2e69388798919c0c396cfdf4d1a3b0e748906d7f3fbe1d890d367
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrmstp.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        • Size 22.8MB
        • SHA256 ac6f2fecadf116528bc855b1e4aba41d34af3ad90dc442fd39858ab88a742dbf
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_pwa_launcher.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 18.5MB
        • SHA256 1452ca248f32aef7373f1859678eb5ecfce3a6a87471cbc3872033f21410d9d6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 19.0MB
        • SHA256 12c7d38630711eb962b1d7729627477e3a153266e1c7c0343664a20143b655ac
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notification_helper.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 18.4MB
        • SHA256 5135bd318fc96c9901cd1037a93426be3a09886ead43d9d7ff1b2f201c5a5c81
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        os_update_handler.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 18.6MB
        • SHA256 17a9900760fd9a612fb5595b2c8ccc0fa165105ddb3487b8c7a1126ffde04681
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 19.9MB
        • SHA256 76913f356211096e7e0a1f1229d71deaf8bc8e95fe0f515a1ea3ea86b1cc5767
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_proxy.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 18.2MB
        • SHA256 b1641d310b70fd988ea3c4bd44a6d755128e29d9f45b58f1a82208bcfc18be0b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 16.8MB
        • SHA256 a2f10cb39b53c1ada3e65ea891b8688002e3b34565f5c1fd52853f145aaee82e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 16.8MB
        • SHA256 268d9b32d8e482de7c73c6d722f9cd61eebbb9f0f580c20fd3f3400b05dde24a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 16.8MB
        • SHA256 be1f768af86c01c04ee012bf15ae1d10048dbc393403c199dc02cd351a35119e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 16.8MB
        • SHA256 93bfe1c5ed2563bf9fd390a12921737e2b1a64c2e6d8937a007c97c9296cfc9f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jar.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 16.8MB
        • SHA256 a58de51c32c61985e3e9e028b58e789c965f809086247746849cbe6be57d67f0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jarsigner.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        • Size 16.8MB
        • SHA256 e4b0f0bcf58d31fd37fd181212f9201ef51feaca282a4a5f649e2d0b7537cf3f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 16.8MB
        • SHA256 3d87ba248e2e4a278b33a1a34b531b2d2f458c926e242aa189b653100aaa6cc9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
        • Size 17.1MB
        • SHA256 3c52eb30b6b0c0950928315752c8c26534d1cc10869c694a2b2dbc3c8d1effae
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javac.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
        • Size 16.8MB
        • SHA256 630a44151aeb230e2d9f4e98a37f008c5f5a67b39ed894fa42c6743581d999e0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javadoc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
        • Size 16.8MB
        • SHA256 1dcba80c4dfbb93b1c34ea8bbd45ec1e52ab4a1e4931a9b7b31b4fccaf90738a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javafxpackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
        • Size 16.9MB
        • SHA256 2f0a1732d99325fd7977570bbaa37773029b066ef97dffbcf860a9e79d1b3304
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javah.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
        • Size 16.8MB
        • SHA256 81a5e536bb28a669f7c29e7650bfdb12025e1fbee5d2647f417b3f91b2299ece
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
        • Size 8.4MB
        • SHA256 d3116cdcd91340462c9631db291c91f3839a9c4be15567ca95139b9a458c356e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javapackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
        • Size 16.9MB
        • SHA256 7d8045d9ef905ed92ee2f9218f688c4dc363fa4b28a2d87512c8e598cec853ac
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaw.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
        • Size 17.1MB
        • SHA256 a8e4b337738c66d00906360263c3607596dd14a8f15e811b07ea946adddd267d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
        • Size 17.2MB
        • SHA256 cb5cc38a227ee7374b13a8f1f72431a3b7f3f8f4341a3618d0781d6e40c0faa4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jcmd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
        • Size 16.8MB
        • SHA256 2ba9916f172e465e8c6db7c864fef7c7cda41be0753c8541ef7cc3c3021469e4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jconsole.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
        • Size 16.8MB
        • SHA256 27fe5bcfb10576b7f85049d2897733f831ea9b9eed697aae8b2ceb110adf6717
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdb.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
        • Size 16.8MB
        • SHA256 754b857bc1c1be1b0760e5ca93f8e3458e7fc7d7d7a19adccae9776d963e1cf4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdeps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
        • Size 16.8MB
        • SHA256 1bc6c820ba828295b11ba05df5656ebe9b56db728e92bf40519f6223faa5e481
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jhat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
        • Size 16.8MB
        • SHA256 024ba36d81a4fef6b95135ce742d13e8d12b4d508267131c764d1fe0bce419de
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jinfo.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
        • Size 16.8MB
        • SHA256 a5408f006ea5d0d55823dbef58f81b5f732ba970c816aba910d0aca689679c77
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jjs.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
        • Size 16.8MB
        • SHA256 3503c549b7e66133deee6ec78c5a056ae5631a62d4ac166b1ae0eea054721117
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jmap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
        • Size 16.8MB
        • SHA256 96c30d4916136c5c464c87128c12da522dd9fac3ede9dcfbaa9fd1db929100e8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
        • Size 16.8MB
        • SHA256 d0bb96e8b0a93c2972a91696462952af667108e44460cf0c1ecddffc3787a9db
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jrunscript.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
        • Size 16.8MB
        • SHA256 74e7bfc4f08e8ddabf46d976f05a56bd66def570fbe0ea58a4b13d71b74eb6ec
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jsadebugd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
        • Size 16.8MB
        • SHA256 8d471f6be414e539e77ee3f385d7f11eacb7ac029df7a7e969705b303ab38285
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstack.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
        • Size 16.8MB
        • SHA256 fbf6e93226cf8db72d6d9c82f28114277a1f550d28a0b66d7d97c296d33d38fa
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
        • Size 16.8MB
        • SHA256 92b84307a18f267a7867bed9f9163f57c93373f048d6bb66a2ebf648d3f83f8e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstatd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
        • Size 16.8MB
        • SHA256 52ad1bcfd39574db917984c28bf49ebe2e4db28cf7e068e0ec450f52f79f71bc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        keytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
        • Size 16.8MB
        • SHA256 bb032198c54d7d95043ed7e6194a7dfa14366735d081f57d74a1b020f8777851
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        kinit.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
        • Size 16.8MB
        • SHA256 90d985989481fbe124e1f3adbab4f5dfa1e2f68d221831baeb33117bd26b39a9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        klist.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
        • Size 16.8MB
        • SHA256 8c9d2394136a13ec141ab3f82cbd21e82014d1e65f29a3a6049d1eb0eecfb245
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ktab.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
        • Size 16.8MB
        • SHA256 e8ce3a6e22e12eb2b53bb3097e8eb2cbf37705e63e228d35eb1e708fccfc9595
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        native2ascii.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
        • Size 16.8MB
        • SHA256 8428b64d8d2891b289b6a4a8399da91e78b91e5d28b4d91c64865ad1e4624d9b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        orbd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
        • Size 16.8MB
        • SHA256 141261a8573be4073d888441456367affe794c29d57c76b54959ba511da82ff5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
        • Size 16.8MB
        • SHA256 c20b8deab5685c82db2540cf5aaefabcf961fa3c5f1a42d9216cb2aac27bb6ae
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        policytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
        • Size 16.8MB
        • SHA256 69983add6635add932dfb021aa0ca83c28189775853a0464d539eea58b4969d0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dotnet.exe
        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 16.9MB
        • SHA256 ce3afe3a70ce9db1590980e7eb323ebc3bb5563f49da273b7461aa66ec67eefe
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 16.8MB
        • SHA256 6a756b0af8774c7243784d327a9001ec6ea090a3faa0ec4b742ac29ede9a2ab6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 16.8MB
        • SHA256 111066d5e695c3f8ad02aa5134caf632cabf594fc0c2d4314b1b09da6cd9e7c8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        spo0lve.exe
        • Path C:\windows\SysWOW64\drivers\spo0lve.exe
        • Size 8.4MB
        • SHA256 b0a29e6303fd208e0d2fd1d09024ab68262223a069181ee1d27e20a6b0e52413
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download