Overview

overview

8

Static

static

3

2026-06-30...ar.exe

windows10-2004-x64

8

2026-06-30...ar.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    148s
  • max time network
    143s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260513-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    01/07/2026, 03:49

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-06-30_91b0da39af6772814c9445460ebadd75_cobalt-strike_elex_emotet_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe
  • Size 18.1MB
  • Sample260701-edd5vsfx31
  • SHA256 3045e950081f8bb9472004a0922f175478d01fce494ba1c1f68da0cd02ada071
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
defense_evasiondiscoverypersistenceransomware

Malware Config

Signatures

  • Drops file in Drivers directory 3 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Sets desktop wallpaper using registry 2 TTPs 2 IoCs
    ransomware
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies Control Panel 4 IoCs
    defense_evasion
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-06-30_91b0da39af6772814c9445460ebadd75_cobalt-strike_elex_emotet_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-06-30_91b0da39af6772814c9445460ebadd75_cobalt-strike_elex_emotet_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:2684
  • C:\Users\Admin\AppData\Local\Temp\2026-06-30_91b0da39af6772814c9445460ebadd75_cobalt-strike_elex_emotet_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe
    C:\Users\Admin\AppData\Local\Temp/2026-06-30_91b0da39af6772814c9445460ebadd75_cobalt-strike_elex_emotet_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:2324

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        7zG.exe
        • Path C:\Program Files\7-Zip\7zG.exe
        • Size 18.8MB
        • SHA256 6f8c27084868cf277fd3ae2caf172a6808c59139f877dba5edb9e72547d0511e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrmstp.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        • Size 42.4MB
        • SHA256 a696eef739fbba4ab62334a0ddf18b50515a49f1e790ae72385c511718c8a03d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_pwa_launcher.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 38.0MB
        • SHA256 109bf4a9670e89116a2cff5ecc5b6d687cf470b3264a2cca3df5e9133f3e1be6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 38.6MB
        • SHA256 ee1bd15fd54704a5eda90d86db9683432f8f61566094ddf5196918a8b6c52c33
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notification_helper.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 37.9MB
        • SHA256 d687cb098cd5e0d66e0446a2149817adfe536178a1e7a1b6293de010e30b0ded
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        os_update_handler.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 38.1MB
        • SHA256 e376323b490ec82ab08f517e5671def2a649d5c5685a6110d8e1b5ef24ab3f54
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 39.4MB
        • SHA256 63162883ffdc9ddf7a3318cb6409348b5170d6e0fe6f8e5294191e14e40af3fe
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_proxy.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 37.7MB
        • SHA256 75f17e0d04c380fbc5fbdfc53afa44200b115ac98bc130ca8880503ed7025411
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 576KB
        • SHA256 9b9dd530b295572b4946420b8542313a6c2a581d9a9ea1114d003faa51914d08
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 36.3MB
        • SHA256 2dd1411af9f21e5a4232cc5fbbd709cc81824baee05ebf4148ffb0ec3b6b755c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 36.3MB
        • SHA256 e982fedece7ecdb6d7a50ae407148f2d13583edfdf9e1190f64d160d0dff929c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 36.3MB
        • SHA256 427789f5c3eff05d562bc20d6c4bb4325f3800ce627cdb8d00fea6652add6cd6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jar.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 36.3MB
        • SHA256 6fe0b8dd0097524d996b3f9c62c011a07dc313adb33ab4c54e208a7411ae1c13
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jarsigner.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        • Size 36.3MB
        • SHA256 65b4b626a1bc63238ec19d99522194ac8235a69ad788ee71d9b44906f16056d3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 36.3MB
        • SHA256 a82a69ac7184738cfedb06c8f1d4b69ef500927cd812455c6922052e6c872ccb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
        • Size 36.6MB
        • SHA256 0ad8a786a5431909ba3414ccb5a9d5b42359cdcdfc8cd0b45edae40f50e87fc4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javadoc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
        • Size 36.3MB
        • SHA256 d318b332d9468c3b8298527d888925a45a99160e72269e8f210150d2921265f5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javafxpackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
        • Size 36.5MB
        • SHA256 8eacf9c2d6f3205a879466631a65b70e21da20b61ebc2fd6c3ecc400fd5e85c2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javah.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
        • Size 36.3MB
        • SHA256 e462cb02dd7eab1aee679b203fba310f8b54653b48b04f65e49b5fafd01511de
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
        • Size 36.3MB
        • SHA256 da1285e3d65017ac2acc9c9dbbe3467fa560514d62d4f22b6c662d55318ac070
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaw.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
        • Size 36.6MB
        • SHA256 a5266ea27f95f6303681bcb13fb3b227a9e5421b271c192ee26b80d0df6e6fe7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
        • Size 36.8MB
        • SHA256 eada4ad25799a38e8b15bd0dd0e2c029e53eae496676831c404e8fad1737829c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jconsole.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
        • Size 36.3MB
        • SHA256 24b40c184bfb52279e17ce9513c7bc0dc69a6c0e502277cd7ccb7ccc2d54c5f2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdb.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
        • Size 36.3MB
        • SHA256 5e5b1b5813eb1940d784949733fabc1b0da5abe5941b3ef3683feb16efce47b0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdeps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
        • Size 36.3MB
        • SHA256 9f1d63b1f454f81f8efc3893c03b0f8dbbf273752429e4ec909a6bec9ea311f0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jhat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
        • Size 36.3MB
        • SHA256 23c5ca68bd73386e2cd931483bbb3eada84adeb2ab511183f4cf0069a1b28f2f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jinfo.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
        • Size 36.3MB
        • SHA256 cbd2a4505fdd0e3e45df298e7679c6d28a4f4ed1ed80fcabd48636f0def5af68
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jjs.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
        • Size 36.3MB
        • SHA256 33a9f9d4f6f08feabdfc3fc97c1fb6a7814a13bcce1d9a5d033e438171eab00c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jmap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
        • Size 36.3MB
        • SHA256 713df67f1e3ae9d12439c885e559880df2bcce9c0a4823d700da35a692b7efb8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
        • Size 36.3MB
        • SHA256 6de767ef50da874cf7003d2c807bd3e44eb3a6739cab8778f1de715789438e96
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jrunscript.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
        • Size 36.3MB
        • SHA256 9f500e8c1cce7bc859ee14bec0a8efd9e279c97a970adc26cfc620edc5f84f7f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jsadebugd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
        • Size 36.3MB
        • SHA256 9105acbb50df27cf6c3d170b1091b9e45fcdc2d728215b4ae92ec5088c37b492
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstack.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
        • Size 36.3MB
        • SHA256 bf7dfcf6261c9d21b6b74bcb794300ea89483f0a884927ac3eaa6d34c5c41866
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstatd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
        • Size 36.3MB
        • SHA256 913a7bca7ec573a0a3e5bf4616cff6c25febf426a2c244f6bfb9f907ac76e738
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        keytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
        • Size 36.3MB
        • SHA256 479555073d43717608478d8d768496feb404f007752f362bbaac764a420da73e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        klist.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
        • Size 36.3MB
        • SHA256 c4e1b5b6d7c45fd1b50755843d9bf28b0329de72ceff12a683ca35fba2a1e053
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ktab.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
        • Size 36.3MB
        • SHA256 a9f8c74ac10a3f4970ce138f8dd8a3582b4a9c5585692a6120745ae728a06c0c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        native2ascii.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
        • Size 36.3MB
        • SHA256 c6a3a2c000b4fc63625d0a993ad013da7b27b92ccefe90c8133b955b4f755f61
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        orbd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
        • Size 36.3MB
        • SHA256 561b40ddfc3a0de88841c9d6a3b407264e7855e9d7fc7fc66cb6c018287b0458
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
        • Size 36.3MB
        • SHA256 be1b3726975eb3afdc408c6e6874bea4a62c6910276581189c39dd4a32bb629d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        policytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
        • Size 36.3MB
        • SHA256 ca9567b6334091c659e08d03a7988953aef735b0180650a0ea7c66b4d0877ea8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmic.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
        • Size 36.3MB
        • SHA256 5d89307ba656bab055441c446bbda2b6de7b32a17abdd611b4918d5d235b04fa
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmid.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
        • Size 36.3MB
        • SHA256 6d80661efe61a8ff2914617e5621e22778a519b8fcae9947e3617d4b82950f60
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmiregistry.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
        • Size 36.3MB
        • SHA256 9ee856971c867fc58029162153424e07cbd9207f3ffa3e0e4a322647a2281950
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        schemagen.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
        • Size 36.3MB
        • SHA256 da3098905def9261e3e303fd185a6d7714a4e7c5a4f330b4174a41f3fbeea7e3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        serialver.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
        • Size 36.3MB
        • SHA256 81e1dc2cb20cd062bf51df0955bd1596f29ef99743e35e23f009e4fe8597fb2c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        servertool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
        • Size 36.3MB
        • SHA256 cdb2f1e7e20a51bc591a96e676e50945b3dd17ef118f5efbc2682c8c87039339
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        tnameserv.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
        • Size 36.3MB
        • SHA256 a2de3a18df30377dc3f46618898119ec4c6a88c47de8f4981e8b9c96637ead92
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        unpack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\unpack200.exe
        • Size 36.5MB
        • SHA256 e77896ce898ae441ecfa714d6eaf4717e1dc733842bdde4af1d5932d952efd00
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        wsgen.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
        • Size 36.3MB
        • SHA256 706317854776b49883b80ac9912b2a49b32b44913abef376a857b47a220d3374
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        wsimport.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
        • Size 36.3MB
        • SHA256 1efc29f5007c8c6dc0528c3e9423251411bb48058024a196f848d955ca298903
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        xjc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
        • Size 36.3MB
        • SHA256 072211f480dca10ad70dec2b9de954e53048cf8ec3069f28d1b6c0ab88f8ce5e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe
        • Size 36.3MB
        • SHA256 63afc68a3e3be77b568fbdda8e85da2b2ec55d836fb4af0bdecc73749f7cc423
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe
        • Size 36.3MB
        • SHA256 6f231776d76d787e37f3e91c76cc394627b15a5dbe1575627b24c2b6086df986
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\java.exe
        • Size 36.6MB
        • SHA256 e7a6948309fb661892ad6b3a4590ea0da50971b469efc02fd6ddf47e5bb76979
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javacpl.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe
        • Size 36.4MB
        • SHA256 98c562b56ed253e542e3c6c190dd6393516ecc00ce3724713d034e9b76dbdf92
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaw.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe
        • Size 36.6MB
        • SHA256 5e336ad052b9b7d437720fc1b260125d4dd3636ab09dabd2efaa0fee84cb53c8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        spo0lve.exe
        • Path C:\windows\SysWOW64\drivers\spo0lve.exe
        • Size 18.1MB
        • SHA256 3045e950081f8bb9472004a0922f175478d01fce494ba1c1f68da0cd02ada071
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download