Overview

overview

8

Static

static

3

2026-06-30...ar.exe

windows10-2004-x64

8

2026-06-30...ar.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    148s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260629-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    01/07/2026, 03:45

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-06-30_9544a7a171e841cda3752eaf321c9457_cobalt-strike_elex_emotet_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe
  • Size 15.7MB
  • Sample260701-ea7b8sdx9j
  • SHA256 29074eb3be84377354aaf5ab21e688841822ffb800697109a5b4ed6bc14c709a
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
defense_evasiondiscoverypersistenceransomware

Malware Config

Signatures

  • Drops file in Drivers directory 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Sets desktop wallpaper using registry 2 TTPs 2 IoCs
    ransomware
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies Control Panel 4 IoCs
    defense_evasion
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-06-30_9544a7a171e841cda3752eaf321c9457_cobalt-strike_elex_emotet_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-06-30_9544a7a171e841cda3752eaf321c9457_cobalt-strike_elex_emotet_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:5620
  • C:\Users\Admin\AppData\Local\Temp\2026-06-30_9544a7a171e841cda3752eaf321c9457_cobalt-strike_elex_emotet_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe
    C:\Users\Admin\AppData\Local\Temp/2026-06-30_9544a7a171e841cda3752eaf321c9457_cobalt-strike_elex_emotet_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:3660

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        InspectorOfficeGadget.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
        • Size 31.4MB
        • SHA256 804ea9b8c3d963547bbf72c10ad94f1407e865602da54eba67a2bb47df9e7b65
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        IntegratedOffice.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
        • Size 35.5MB
        • SHA256 3b5368353d08bcc4f6de86f8842e8c918c4c5edcee0f7fe4af798dce9a9cc174
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MavInject32.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
        • Size 31.7MB
        • SHA256 396840bc1a45b5f69ffb16efce6971c5f62bed6be14320ab45d009228ccc1846
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        OfficeC2RClient.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
        • Size 54.8MB
        • SHA256 e7f74e9f0b54c561f019697ed71a63f0eac093e00121dd8a8af9e28c28a038d8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appvcleaner.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
        • Size 17.8MB
        • SHA256 80cacc79478eed29840497335e52fac1993c0065319af6428e19391291ed2d34
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VSTOInstaller.exe
        • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
        • Size 31.5MB
        • SHA256 2745cb981292a376fca9f08d327e421c338ac37684db3e9a091de0c83cfa9d71
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrmstp.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        • Size 37.4MB
        • SHA256 e4fe8be9a6c12d7019773f2ca96e09aaf0a7e8d3b9ef1387c31cf18451d0ae8d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_pwa_launcher.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 33.1MB
        • SHA256 900314f1ecd257b23695d448034bf8cc5015f0da0e209683043b56deb7a1a756
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_proxy.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 32.8MB
        • SHA256 ad576045081ec517ff19509e66a900e134e2da00e15d18f03d82aabe3c31eae2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 31.4MB
        • SHA256 c0ba8658973d1b4ba5dc19dd978b1d07669f62f30d9a024c2f3cdd5a46f95271
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 31.4MB
        • SHA256 62b649d85d29a362ab8d7b207184918a4d0e362b6aac37182de39feccb8403f7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 31.4MB
        • SHA256 03d2f1ca8adf89a7ae040298c251dd41f280b1ac35c12cc2f914beac361aac00
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 31.4MB
        • SHA256 bbdc1e1964b6541dbb3a0fa712e502366b671c685a24b89baae2bf73154072fd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jarsigner.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        • Size 31.4MB
        • SHA256 d5c70204bb2979efa387dac540793779e3e2e877f098d591b536eb2e392eb399
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
        • Size 16.0MB
        • SHA256 01df3118bb71e26b0701ffdb52b90b883ec9a8e2aac0c9aa94fec176c0433235
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javac.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
        • Size 31.4MB
        • SHA256 e15c27d580e426cb84feb4640a3cc211748873857beed5f7d09c1cc1bdfc4d7a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javafxpackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
        • Size 31.5MB
        • SHA256 67040fa4416c3156b5778f418b21d7efe2ee427803237af32cd27cd45db3bd3b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javah.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
        • Size 31.4MB
        • SHA256 1c730d870bd8c99fe62b3ca3a5204156f1b016b7881336a563593ff8bdddef2f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
        • Size 31.4MB
        • SHA256 110eba7b4d9bf7580f556f69818faf102d257eb10e5658d9d716cf0b7d691271
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javapackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
        • Size 31.5MB
        • SHA256 a9e5a9639d38bbd817a1915e326a552af33374e1298672807d0821e312afa5ac
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaw.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
        • Size 31.6MB
        • SHA256 4d26ed6c7e07c7419edc403ccb5c94da3a9ec9eb309dda56f651194c91e03c54
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
        • Size 31.8MB
        • SHA256 0232cc040de50047bcc5eb8ebd93ce56ad4ddf540c71f7fcc59104abd862fedf
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jcmd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
        • Size 31.4MB
        • SHA256 878418897d3cc48e4deb391afbce98a5d3fdc6f04e6383c9d9f40e0183cc77dc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jconsole.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
        • Size 128KB
        • SHA256 e52488a8a3c5c15a2f928eb2127c84d20ca0143b2598bd3c627a271a6a7a3d72
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdb.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
        • Size 31.4MB
        • SHA256 4fd6e4d87d51e67dac94bf8f41eeca5eb0b865a71e9444135f8ec128ac656bef
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdeps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
        • Size 31.4MB
        • SHA256 372f86a7b7bbe5779798a990c681953767eb5ebf7e47dd2434d52b3df5fbc72d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jhat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
        • Size 31.4MB
        • SHA256 f17e105acddb92e42da0ea1291fb1d755301bc52981fdbbd2fa39b61d79d9f19
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jinfo.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
        • Size 31.4MB
        • SHA256 3f4e1451ed8ad68f94000f815ecb9eb2c215d9aa731b9d277d39ad4b57933374
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jjs.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
        • Size 31.4MB
        • SHA256 9ab90729069e6538c6504b071ebbb0e1b5404fc2e465eebb39c0ef541b327bbf
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jmap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
        • Size 31.4MB
        • SHA256 f240fde9a57ec6d0832524b669f714db0e044377bb4b564e625f3e659bcca251
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
        • Size 31.4MB
        • SHA256 58e8e7d3be5e4bb7db8d17f69a0516c21ea5d5018a4773d3879ae1c4a480c973
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jrunscript.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
        • Size 31.4MB
        • SHA256 1269bf3d546881f6cac97dbeac06d5be43c42c84932a696f0535c8ad238f058c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jsadebugd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
        • Size 31.4MB
        • SHA256 52d476046615b5fed1e3d07aa78e6303e5fd2ea6b7ef159671f7fef4bc66c127
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstack.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
        • Size 31.4MB
        • SHA256 744f5aaf4e1361b3ce6f97dc25237ca8da53b2af5ed04dd52f53e77574682270
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
        • Size 31.4MB
        • SHA256 1d15d28dbce0d51ced27f4f1dee6461ae53df50a81cfa03c12b2f4bfebba05b1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstatd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
        • Size 31.4MB
        • SHA256 32d1dd654e3960fff59cf4074857a65222c6077dec1c2967983bf0e8740c9929
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        keytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
        • Size 31.4MB
        • SHA256 a4f8d01aff1c345df2f423d9a2336ac6934866ad73df54686602f416399c587f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        kinit.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
        • Size 31.4MB
        • SHA256 a7e6b55c2b7bac31b0a4ad50aecfd3c88ab060026c7e0a377848c5c1bbc628fe
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        klist.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
        • Size 31.4MB
        • SHA256 b1a97e20f285f974b12de13a682be69e06832ae32854fb4b7e8dd7084f1fdcb5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ktab.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
        • Size 31.4MB
        • SHA256 c1da5085ebb5d0943475a99146964dc480f5ea727fef4495ed65ff35a7b21f1b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        native2ascii.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
        • Size 31.4MB
        • SHA256 da3759e7ffc2e6473a1a18a713942ae613082120c541bdb84a6e9181ebeb269e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        orbd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
        • Size 31.4MB
        • SHA256 26bec357bb9f8722363a27eaa28e81a062213b22de8dd85ae527f0eb944b2b98
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
        • Size 31.4MB
        • SHA256 d3d90f36e57f34a6a7192a1ff06cfc6fc56dc21c85758b7f7e3d2a4f421d6f5c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        policytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
        • Size 31.4MB
        • SHA256 cef1ad01f6c7d2e7a1136f3c130658d06945989bbdf5ae26ece905d964557ef1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmic.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
        • Size 31.4MB
        • SHA256 a0cb3b88853f7fe84d10b0983dffa119b00eec6b7d086fee0361821e36010aae
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmid.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
        • Size 31.4MB
        • SHA256 50733597fc2cc904082f9a28dd86f973c65c9e2d174282e43b53b33c342d2d76
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmiregistry.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
        • Size 31.4MB
        • SHA256 7c38e25f32f575dc41bd0987f98627f8d53e0139838f3efbdfbea7750c0d582b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        serialver.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
        • Size 31.4MB
        • SHA256 8c6f02788a72f35fca7bf0ce8efdc85e913fb333d45bc054539976d8ee878f33
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        servertool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
        • Size 31.4MB
        • SHA256 1cad76a75a86e24bbb495e23592998e03b6f03c21045d42155d85cf0456f6d46
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        tnameserv.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
        • Size 31.4MB
        • SHA256 b6e01b64e90337c70014de5c1a2aaff5d5b8512376f5a4095276c9d9d1fd06d9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        unpack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\unpack200.exe
        • Size 31.6MB
        • SHA256 d4705f21f6f1dccaad9f4dc068f5d0995e92e0ff8c6ad0b42ecde9f81ecc96d7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        wsgen.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
        • Size 31.4MB
        • SHA256 d54e2563204f838c89143b3f582ce2aadba26561e6da59a6c770e23a8e3731fd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dotnet.exe
        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 31.5MB
        • SHA256 f4350c463ea2c38d7374d64b6a34e53018fda30de3f881f0974f9c86d972a6db
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download