Overview

overview

8

Static

static

3

2026-06-30...ar.exe

windows10-2004-x64

8

2026-06-30...ar.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    148s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260629-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    01/07/2026, 00:20

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-06-30_1d0ea1938d54585f4ffe103592ce8d13_cobalt-strike_elex_emotet_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe
  • Size 7.1MB
  • Sample260701-am2v3aa13j
  • SHA256 6fb37820e734671e7caac92da9a81fafd7eecb15286867faacb8141239ad131c
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
defense_evasiondiscoverypersistenceransomware

Malware Config

Signatures

  • Drops file in Drivers directory 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Sets desktop wallpaper using registry 2 TTPs 2 IoCs
    ransomware
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies Control Panel 4 IoCs
    defense_evasion
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-06-30_1d0ea1938d54585f4ffe103592ce8d13_cobalt-strike_elex_emotet_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-06-30_1d0ea1938d54585f4ffe103592ce8d13_cobalt-strike_elex_emotet_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:2516
  • C:\Users\Admin\AppData\Local\Temp\2026-06-30_1d0ea1938d54585f4ffe103592ce8d13_cobalt-strike_elex_emotet_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe
    C:\Users\Admin\AppData\Local\Temp/2026-06-30_1d0ea1938d54585f4ffe103592ce8d13_cobalt-strike_elex_emotet_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:5568

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        7zFM.exe
        • Path C:\Program Files\7-Zip\7zFM.exe
        • Size 8.0MB
        • SHA256 6f97d97e7aadb6e877d3e72ec262da58d199e33388c1f4b26cd27b1cb5e7d440
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        7zG.exe
        • Path C:\Program Files\7-Zip\7zG.exe
        • Size 7.7MB
        • SHA256 25bc9a3947620645e600338dafacd3b0807a4bd978382b600843490c836f992e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Uninstall.exe
        • Path C:\Program Files\7-Zip\Uninstall.exe
        • Size 14.2MB
        • SHA256 fe5f884fec2bf7418945e2d0f96f396f1d12ac0b3cff676919bb4dc7d27d43d7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        AppVShNotify.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
        • Size 14.4MB
        • SHA256 637cc28c42f9e2c7f0e8198dc6504392ab501f83eb46d8e080ccde4c3117fd50
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        InspectorOfficeGadget.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
        • Size 14.2MB
        • SHA256 e92e7bd698c9550117bfb5a9d804639a23e15ec1f2754d49b024a6993581cee8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MavInject32.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
        • Size 14.5MB
        • SHA256 b4ab08dcdc5cac87cad96fdac090133c6bb322ddcba345c5fe60242dd8e3e241
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VSTOInstaller.exe
        • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
        • Size 7.2MB
        • SHA256 93fc832ce26521d319c48e310d3a25a10e71ee5a4092b1d9e4b3472cfba3fc13
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrmstp.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        • Size 20.2MB
        • SHA256 eac141970379953cfa7bf718beafd70702378ec5efeecd3c31fe17e334cfc01a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_pwa_launcher.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 15.9MB
        • SHA256 5737bdaa5304ff6e667107b138ff87918e6a2ac72e53acb76a1cc0e1a7a57d60
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 16.4MB
        • SHA256 eb209cc2478ca5fb6c13bc57b8cefbe6d71d2594b46bbbf94c151dfb7820c2e8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notification_helper.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 15.8MB
        • SHA256 e072161a35747e6d7ba9218c525385096e48c069e6cce231925db55c957759b8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        os_update_handler.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 16.0MB
        • SHA256 12ff41faa29f1d5e1f8a5e8ddcd0ce94f48bbaf6d978d853c8a0df26ef879579
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 17.2MB
        • SHA256 7ee4b38703b3306ecd6a3dd8222f33f044aa4edfd7377e9314c71ae94f6b1a26
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_proxy.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 15.6MB
        • SHA256 9707fff68fe815a7e6eef10741d0f3ab5b5693c4267651974c2b9d5d0136d6d3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 14.2MB
        • SHA256 841fe708eca565f0b727034bfbf0724ae6456916d09a92ccf7ed45910780d366
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 14.2MB
        • SHA256 0a3ce1d4b79a02a5c94154cc83856fb36b9274f5e6b68d256982e474c6613b06
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 14.2MB
        • SHA256 b12d186c1e9650a0b4c4d2d87067ebc510529c495e8e089c70d1b73b3d056957
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 14.2MB
        • SHA256 745a584ef0ad6bf711d72e0c5ed67b53039d9925d810dbb7e5fbfe0151ef720a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jar.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 14.2MB
        • SHA256 1eeca2cd46725e31dc4359e29ae04e6735b4eac62310b8d2e1c6f48663242d8f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jarsigner.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        • Size 14.2MB
        • SHA256 f94849f1f7a63e9e046fbf2726f24b42fb1376164788b61804016c5a477dba33
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 14.2MB
        • SHA256 dce40d945d3cb070aa8625c1cc5cca134ecdcbed31e1dcde8d74d43104dfa89e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
        • Size 14.4MB
        • SHA256 77f80f1b7792f2a225fc629be1d112c8a9da0f55e6d1f15b3dc73ea60d1b9848
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javac.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
        • Size 14.2MB
        • SHA256 eff7671f0c3e3b8806f805f502923f9f9c76619bce16a2bfa919e5d8c2eba2f1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javadoc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
        • Size 14.2MB
        • SHA256 4f8424d5a75686f57828f52cbd2a1e60bdccc7bb47e5f8ae4578d53f31bd4558
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javafxpackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
        • Size 14.3MB
        • SHA256 45f89963a21d2809aa77b1e267d60874bd93232849aacba1661723ba9bae7d2d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javah.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
        • Size 14.2MB
        • SHA256 dd0235296491c9b6f27f649a50b911ef1c21c05b4f10b1f51bc2e2a4cd19afb0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
        • Size 14.2MB
        • SHA256 5918cbdb9454d4fb2f2afabf9d3eb90a13a79bcfb6c916b89c1457baaa923c3b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javapackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
        • Size 14.3MB
        • SHA256 8327f814b21a61cd5dedfb83b18c056fc7031e20aa681d0b330af557f8835d91
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaw.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
        • Size 14.4MB
        • SHA256 7054173f0ddef99f16c09f371535dde7831fae42c72e615daa581efb9da74739
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
        • Size 14.6MB
        • SHA256 23e8239368747ebedc9a3ac5e7bf8b12afc9708bf8a0779fff286810e68cbada
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jcmd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
        • Size 14.2MB
        • SHA256 5c48237d7796c7d8d3a8bc3e4227199aad256a7ecfea07e4803808ddc1fb300a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jconsole.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
        • Size 14.2MB
        • SHA256 497f97e6acaf78bf4ca9c65d60944bdd64ff7fb41fc8e1f24438c750761c6380
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdb.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
        • Size 14.2MB
        • SHA256 358081eb40a2303c4a4a526633d75685ee23971a0b5647b5ccd22553a304c2ac
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdeps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
        • Size 14.2MB
        • SHA256 881c9d4ae696afd96e5b5fa0a64481f3642ea259bc82d8130582c3d33cef1d0a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jhat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
        • Size 14.2MB
        • SHA256 6fa1d9c8b7e92dd1445171fc0d7fb2642a153f4377b112bbe042462c7c24a963
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jinfo.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
        • Size 14.2MB
        • SHA256 0e5cd78ffc91fd618936885b11a7e2f2d422735a76040e01515d67bef4939fac
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jjs.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
        • Size 14.2MB
        • SHA256 4d2fb265637833a82e3b36e72a1a825d87574d808257b0e0ce68eaa3c3792811
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jmap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
        • Size 14.2MB
        • SHA256 9f974dc6c25ad3ad5ca4b39c08455706c076ac02006af88f70f6d2a9af1a3844
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
        • Size 14.2MB
        • SHA256 85c9617c0e1466bcbfe46fcff188c2789ed5285a87bb40a2e673e126a903641b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jrunscript.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
        • Size 14.2MB
        • SHA256 6acaaab8422a0fe75ccb0300ef60cb2b88061381cd6e13516430747b14818984
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jsadebugd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
        • Size 14.2MB
        • SHA256 7cedf78cf57327dc565ac32333dc76dd2c2ab21c5afcf1c169b16e9afe59ebee
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstack.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
        • Size 14.2MB
        • SHA256 170be72b955b7e03d8cf022059aab3df3f713b86895a29e3a44dc4f461d0dd1c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
        • Size 14.2MB
        • SHA256 80b47b533e337091595e4708754da6ad51a1b92e05cef7a76be43b098f3612e8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstatd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
        • Size 14.2MB
        • SHA256 6f300b228b3925c398dd4caa29d04b17c5b659c5409ab534f3a170a9200e2534
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        keytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
        • Size 14.2MB
        • SHA256 ad203455637ff8bfe97beea00a199fd66ab28aff1b853e53ff27aad0e99a1ccd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        kinit.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
        • Size 14.2MB
        • SHA256 bc0ffac10345f078f917d35f794f0dd0dbf7efe36503191232781bc605f75b0f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        klist.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
        • Size 14.2MB
        • SHA256 334b57058dee158d469d9429e4d1197b282de6155845567fa2171fa0c97b6e1c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ktab.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
        • Size 14.2MB
        • SHA256 df5100c53f3fdc8873316f25b8b1c6296415c4b2ec2d62cc2d4da1756fa95f65
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        native2ascii.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
        • Size 14.2MB
        • SHA256 bf4119ae9df8fe9bdc584295805bd7993bd9ab4d39c0262503be1dd23e46bcfe
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        orbd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
        • Size 14.2MB
        • SHA256 20fa4ebc4e18d1e073ecfce16eef7b4893e7d4326858082a358f226484eadbbc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
        • Size 14.2MB
        • SHA256 b072153376e5f9f9f9f82839ba443622e7cabf8b0814013dbe4bef9c6b5d17ac
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        policytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
        • Size 14.2MB
        • SHA256 3b852f82472474e8c245314f61bd37d6e5c437ec261318d8526be8ed99e87990
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmic.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
        • Size 14.2MB
        • SHA256 0b2533ca6cf25068bb0bda1829b01f9e4e1036ea11a288415d95d0d6c3e4ab69
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmid.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
        • Size 14.2MB
        • SHA256 e699c0054eff46fab721c49dce83bf0929a45214efe9dabf9e9d5d5c7b5888a4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmiregistry.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
        • Size 14.2MB
        • SHA256 8be6d772beeb0c97c3a35c50989060040846422e9537a97ce5a924cbf9456b17
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        schemagen.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
        • Size 14.2MB
        • SHA256 c5b83471e392b2f5e382dc5fbce71bbd6c5c9d8d2a8f016fe9aaa7e1bce3bd75
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dotnet.exe
        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 14.3MB
        • SHA256 216542e1c8d3b3abc0dbbf586c492e1077e67ef917759989f005128fbb6f76b4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 14.2MB
        • SHA256 faba45f2e787819c91c65225dfdcb7dff6155a0baf0cd9bd7b62c29938b3219a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 14.2MB
        • SHA256 91a4e2bf0f5beedac81c131c8352de3d8b45a8c08ff6859e4389d6a13a10388e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download