Overview

overview

8

Static

static

3

2026-06-05...os.exe

windows10-2004-x64

8

2026-06-05...os.exe

windows11-21h2-x64

8

Analysis

  • max time kernel
    149s
  • max time network
    150s
  • platform
    windows11-21h2_x64
  • resource
    win11-20260513-en
  • resource tags

    arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
  • submitted
    05/06/2026, 14:30

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-06-05_f59303a9e9dceb39efc2277702b89c01_elex_emotet_glassworm_icedid_njrat_remcos.exe
  • Size 1.6MB
  • Sample260605-rt43faa19j
  • SHA256 dc63f6b748d6a3c753fabe4f9982dea2e899d403eb2e64dfaf22c8db39a51f1b
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
defense_evasiondiscoverypersistenceransomware

Malware Config

Signatures

  • Drops file in Drivers directory 3 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Sets desktop wallpaper using registry 2 TTPs 2 IoCs
    ransomware
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies Control Panel 4 IoCs
    defense_evasion
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-06-05_f59303a9e9dceb39efc2277702b89c01_elex_emotet_glassworm_icedid_njrat_remcos.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-06-05_f59303a9e9dceb39efc2277702b89c01_elex_emotet_glassworm_icedid_njrat_remcos.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:4396
  • C:\Users\Admin\AppData\Local\Temp\2026-06-05_f59303a9e9dceb39efc2277702b89c01_elex_emotet_glassworm_icedid_njrat_remcos.exe
    C:\Users\Admin\AppData\Local\Temp/2026-06-05_f59303a9e9dceb39efc2277702b89c01_elex_emotet_glassworm_icedid_njrat_remcos.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:936

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        7z.exe
        • Path C:\Program Files\7-Zip\7z.exe
        • Size 2.2MB
        • SHA256 636073ac6bd911a87d7ce77f4fb2e8f2a1558d3f9dc24f59fd0ad5e0e05bb45b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        7zFM.exe
        • Path C:\Program Files\7-Zip\7zFM.exe
        • Size 2.6MB
        • SHA256 cfe8a036c39bd4ac1096186d50410d3d75f1df0d21c791ff11ac9de130255bfe
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Uninstall.exe
        • Path C:\Program Files\7-Zip\Uninstall.exe
        • Size 3.3MB
        • SHA256 088d10bd1a07f6d1e75e506cb8d0e33fce51d718d46b1d84e7edeb73046a037d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        AppVShNotify.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
        • Size 3.5MB
        • SHA256 65623ec48d7f64baa4e1e29b023cc15422bcf77180c74b27c52902eebef7d5f5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        InspectorOfficeGadget.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
        • Size 3.3MB
        • SHA256 3430ca967d1076c7bd47f02e9a390759ed9e5868f8d3e0eacc0bc04f4e4c2f3b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        IntegratedOffice.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
        • Size 7.3MB
        • SHA256 3af2d3f6281b7239297755c838a1001ca54dedaa3c68ca5f1b8d02dbf4c673bf
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MavInject32.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
        • Size 3.6MB
        • SHA256 b466e34e547460b04cdabf0d679974685f12fa86f493969b01b15267782cc637
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        OfficeC2RClient.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
        • Size 25.1MB
        • SHA256 a9fdf4fb6adf6caa2a9141c2b2e8c382454d5e53e1ec074150b574f35a936f64
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appvcleaner.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
        • Size 5.4MB
        • SHA256 d26df85f8a910b565ed366f3c4bb26aa0e71a63f9a3bf05b8d50990845c2c7de
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VSTOInstaller.exe
        • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
        • Size 3.3MB
        • SHA256 42043622161f0305202ae48111b5ded69effb6b84ddd4261840a530bc602acbc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        DismountConfirm.exe
        • Path C:\Program Files\DismountConfirm.exe
        • Size 3.8MB
        • SHA256 c6035cfc7c3a6ebe6a5b39db21e848d7d4a63e1c572865a25bd74a79d8762025
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        setup.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
        • Size 9.3MB
        • SHA256 b1394e414f5aea7ceb0df3b213aaeed37057ccd9dd3b0a1d47e593b310f0f88a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_pwa_launcher.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 5.0MB
        • SHA256 820a6238c233c94cc7621e59824c104be1b14860cde0296a4548cb3b6a7338b5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevated_tracing_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 6.7MB
        • SHA256 6560c0fed7ffd9f932a30e112bfc4fd29b57d4f45c4f9049650080ccffd2664a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 5.5MB
        • SHA256 6ac7af02a387e52f2e7a65dc83f2f13ae1f1c0f85cea3085ee6ceaaa8a450657
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notification_helper.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 4.9MB
        • SHA256 0a2fb8b8325cfd10fe7f462c90bf6b93c9bcbc9f4613c1ab5d0289bc0b0b3cd0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        os_update_handler.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 5.1MB
        • SHA256 8f4b4222f89d0b4b6c8f87dee5f7d22cf20ab91a051a8d41bc65e9af9023fea8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 6.3MB
        • SHA256 d1653082b0838a6be8fb646cc4bc3758b714166f3bf398a33eaf512a564d214d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_proxy.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 4.7MB
        • SHA256 220d6f79c484fe2aef89a5643e54cbc9004202340a6df25cc4bc923d99e4ffcd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 3.3MB
        • SHA256 7dc7b70773e121e3d53aa5a102c8706aa2503cb9bb2ba458e0f6b4e1a1abb642
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 3.3MB
        • SHA256 bd0abde5630d7b7d8a44ca8bab4232bbd17018950e1f8d9fb93acba216e5cad0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 3.3MB
        • SHA256 ade53906d6086be4832e02cd93fe8e8684f5b910a7a77517571cf955f481bc51
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 3.3MB
        • SHA256 2e9a6bf87013c88be5e2828f7220577c7d703a7a2ba388797e171816c418b1b2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jar.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 3.3MB
        • SHA256 32fcd72d31dbc5841013be187a3bec15e3178ea30d85cdbd42caf938f0a74d04
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jarsigner.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        • Size 3.3MB
        • SHA256 f90ca5df7962535b63bab9f74154b0274575b211f08d531546ba64370ef1f5e5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 3.3MB
        • SHA256 00fdc8f7d8e9ec6f241000d4ae3093c40fd9ae06abd9a8b2d1133ffa6116d738
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
        • Size 3.5MB
        • SHA256 5acb4d868f7892cd25ba44eb81b07cf3cb9f0fa4f811556e24c4d0d51f70838e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javac.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
        • Size 3.3MB
        • SHA256 c1099ddd5823e452a4cae452da9e816c1f7202458b719919e24b4a7720425954
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javadoc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
        • Size 3.3MB
        • SHA256 923140635e2594d9b8585968a6219e44836291bcfcb847e255f95ea48aefaf61
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javafxpackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
        • Size 3.4MB
        • SHA256 7447bb2b31e53d3870ebefd7f218149694731b0143ba7b89ee287e264e581af7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javah.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
        • Size 3.3MB
        • SHA256 eb6aa38f0ce9538904bd8d8db249a56de5c174221a4ae13bafd26230505e9a8a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
        • Size 3.3MB
        • SHA256 d7c3c7a2034abc0d8f8eff10e5a65ca6eb8d087a78dc03e29679f88e290cba3a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javapackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
        • Size 3.4MB
        • SHA256 a7a73db38a19d2aa16cfe6d0809ea1e1e5bee9de7820330c9cd5354cfadcfe22
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaw.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
        • Size 3.5MB
        • SHA256 4d921992eedb44e124034f7f5036f8a7a3d9d0531cf453d22c51b7e47d19420a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
        • Size 3.7MB
        • SHA256 0fbf02dd7180556f979e923470197f05cae5f3ce890d151a9e38857f29bb0909
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jcmd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
        • Size 3.3MB
        • SHA256 94c97260ce6a03e7017d27aa873857785e58ed416fac9d8d0107a79a25e11117
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jconsole.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
        • Size 3.3MB
        • SHA256 9417e174e81e7555bffc91142d02f332b5e0544b3de3afcdd10233347ee79d81
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdb.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
        • Size 3.3MB
        • SHA256 354c786b64a225d657ad8e03ca4c07368bebc7fbb86a0d1d75b6e1ea6c384bfd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdeps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
        • Size 3.3MB
        • SHA256 27bfbd07be755f65aac547d8aac36808e6bf1ce0fe3ff8e2d275eff8109c54c5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jhat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
        • Size 3.3MB
        • SHA256 ee992302257a770c8267f844cf9b3646b2bdb5d674849b1df6a0f125e7c2e6ee
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jinfo.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
        • Size 3.3MB
        • SHA256 128101275fe484634f56e3ff1d346531f5d5eb1c8ee16c5ad968b74145d3e966
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jjs.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
        • Size 3.3MB
        • SHA256 58f099ee5c44054da830ffa025d771fa9c0ca35bb149b83894c508e38a2ac5da
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jmap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
        • Size 3.3MB
        • SHA256 c47c8ccdf3810b6acd8b5991975127c6f06626cf9ed90d62c39713fc01c17fa0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
        • Size 3.3MB
        • SHA256 b274df0b9e42b6e1b374f6b87392cc6c167128426ee76ae8864c901c4d3bcddc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jrunscript.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
        • Size 3.3MB
        • SHA256 0a1bc422ca869ac5fab0fdcdc33a4a17a5daa43daaa2d04399e817a01494dd47
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jsadebugd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
        • Size 3.3MB
        • SHA256 e26ec4d22869198053da470425bfff8f0df8956518f1b8479ea1e7adb11a7068
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstack.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
        • Size 3.3MB
        • SHA256 4b24e87bacc3045355fff0daa29a654e2fdaa415183ef9e720f2269926fcb89f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
        • Size 3.3MB
        • SHA256 6fbeb627e709874c9fd2dc686cc01d57346c43ea5ac4754a105c207c9f8a9af0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstatd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
        • Size 3.3MB
        • SHA256 e0856ccc0c0f23457ffd8e53a32b210a4d07d0fa2471fd598142acd4ee328322
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        keytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
        • Size 3.3MB
        • SHA256 298cf52592b7ce452f64e7d614d653ca242151980f692494675d935b90499bcf
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        kinit.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
        • Size 3.3MB
        • SHA256 d08b4b5370f661591e74f35575229db1c3f655b1016e02d3f66b4a19f3ae9241
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        klist.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
        • Size 3.3MB
        • SHA256 611cbb492517224ff6a1b738a67540ac48173a2fd467d4138ba0a09045cfe41c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ktab.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
        • Size 3.3MB
        • SHA256 0aade0f9e9d8cdb924b1bc4b355d27e68ac322052499a05612bc6ef7c017c6c6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        native2ascii.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
        • Size 3.3MB
        • SHA256 f26edad0160b05bff29e563750d6fe9b83ac65c5e3b0864df49fbcf50bc302e8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        orbd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
        • Size 3.3MB
        • SHA256 67e73dc681f618bed40abd45137341ce5ffaa5267a0fea2fe3b2bc46210f6de4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
        • Size 3.3MB
        • SHA256 2196768ebec884918042a3f66f7018c2eb0ebcf525b4681a3dac78cf0f880e87
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        policytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
        • Size 3.3MB
        • SHA256 876500f941e3aa7bcbbbc9ba198520d978f1e1b6ef1485f5c61016a662c6d8e8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmic.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
        • Size 3.3MB
        • SHA256 01d757d5a8c94554a6fbbe76d0f2e5dce0526ce18055d83b64db86b641e750e4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dotnet.exe
        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 1.8MB
        • SHA256 c21fae7e0768056bf344de49531b061b97076a402274e687d776cb5db2343da7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 3.3MB
        • SHA256 1e7789b2f086ae234d6cae2bd2f7a1e7054e5054b048771e810b3b70bd9bf5c2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 3.3MB
        • SHA256 ef0f3750557e747c81510cabc5f50fe784bb42595cfda7a88be78d064715fc17
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 3.3MB
        • SHA256 a47a2d47e6c6c33f333bcf35513fd69b128e591fb9935d80be095eaf7ae37c16
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        spo0lve.exe
        • Path C:\windows\SysWOW64\drivers\spo0lve.exe
        • Size 1.6MB
        • SHA256 dc63f6b748d6a3c753fabe4f9982dea2e899d403eb2e64dfaf22c8db39a51f1b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download