Overview

overview

8

Static

static

3

2026-06-30...ar.exe

windows10-2004-x64

8

2026-06-30...ar.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    149s
  • max time network
    145s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260629-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    01/07/2026, 03:49

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-06-30_91b0da39af6772814c9445460ebadd75_cobalt-strike_elex_emotet_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe
  • Size 18.1MB
  • Sample260701-edd5vsfx31
  • SHA256 3045e950081f8bb9472004a0922f175478d01fce494ba1c1f68da0cd02ada071
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
defense_evasiondiscoverypersistenceransomware

Malware Config

Signatures

  • Drops file in Drivers directory 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Sets desktop wallpaper using registry 2 TTPs 2 IoCs
    ransomware
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies Control Panel 4 IoCs
    defense_evasion
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-06-30_91b0da39af6772814c9445460ebadd75_cobalt-strike_elex_emotet_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-06-30_91b0da39af6772814c9445460ebadd75_cobalt-strike_elex_emotet_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:5524
  • C:\Users\Admin\AppData\Local\Temp\2026-06-30_91b0da39af6772814c9445460ebadd75_cobalt-strike_elex_emotet_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe
    C:\Users\Admin\AppData\Local\Temp/2026-06-30_91b0da39af6772814c9445460ebadd75_cobalt-strike_elex_emotet_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:4132

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        Uninstall.exe
        • Path C:\Program Files\7-Zip\Uninstall.exe
        • Size 18.2MB
        • SHA256 89356ccdde7b62a7c9afcc18019c3e650f3dc0bd8b1d2d71eff8b73726d349aa
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        AppVShNotify.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
        • Size 36.6MB
        • SHA256 a32833d9198e9f48ca0fefc407f6d24500df292dfde8e03448bbc387a5a5e7c0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        InspectorOfficeGadget.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
        • Size 18.1MB
        • SHA256 3045e950081f8bb9472004a0922f175478d01fce494ba1c1f68da0cd02ada071
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        IntegratedOffice.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
        • Size 40.4MB
        • SHA256 5a5e0fa0697571ab1ba4aaf87cf469526cd5b31ddf8dfd7dc0a2fbb7afe52813
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        OfficeC2RClient.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
        • Size 59.8MB
        • SHA256 09b97f52608c04fc715605e3bded7c989792f52e1ca5f62f25529576e34612a8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appvcleaner.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
        • Size 20.3MB
        • SHA256 4d6009dc1b5ddc1abd8592ad2cd4d52296ecaf2576e90f2b1ceed465c4c6cbf3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VSTOInstaller.exe
        • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
        • Size 36.4MB
        • SHA256 57198e9f0736dadbc2ccc3e655adc3bfe547aa2e649b259ef87ef20959e3013d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrmstp.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        • Size 42.4MB
        • SHA256 a696eef739fbba4ab62334a0ddf18b50515a49f1e790ae72385c511718c8a03d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_pwa_launcher.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 38.0MB
        • SHA256 109bf4a9670e89116a2cff5ecc5b6d687cf470b3264a2cca3df5e9133f3e1be6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevated_tracing_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 39.8MB
        • SHA256 5917b85da6918741c56616c55eefef049ccac44098b25fbe84382c28bc0b75a6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 38.6MB
        • SHA256 ee1bd15fd54704a5eda90d86db9683432f8f61566094ddf5196918a8b6c52c33
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        os_update_handler.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 38.1MB
        • SHA256 e376323b490ec82ab08f517e5671def2a649d5c5685a6110d8e1b5ef24ab3f54
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 39.4MB
        • SHA256 63162883ffdc9ddf7a3318cb6409348b5170d6e0fe6f8e5294191e14e40af3fe
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 36.3MB
        • SHA256 66b5c01dc2fdc461e6b651ca911de54da7d00b32365df0d65f9cd13d0c8e8602
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 36.3MB
        • SHA256 2dd1411af9f21e5a4232cc5fbbd709cc81824baee05ebf4148ffb0ec3b6b755c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 36.3MB
        • SHA256 e982fedece7ecdb6d7a50ae407148f2d13583edfdf9e1190f64d160d0dff929c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 36.3MB
        • SHA256 427789f5c3eff05d562bc20d6c4bb4325f3800ce627cdb8d00fea6652add6cd6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jar.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 18.2MB
        • SHA256 063b13a092ba119f5de9a028ac3fa3a687371c3df9a5372fd41bd75b0f1d8e05
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jarsigner.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        • Size 36.3MB
        • SHA256 65b4b626a1bc63238ec19d99522194ac8235a69ad788ee71d9b44906f16056d3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 36.3MB
        • SHA256 a82a69ac7184738cfedb06c8f1d4b69ef500927cd812455c6922052e6c872ccb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
        • Size 36.6MB
        • SHA256 0ad8a786a5431909ba3414ccb5a9d5b42359cdcdfc8cd0b45edae40f50e87fc4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javac.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
        • Size 36.3MB
        • SHA256 088b6dd4fc7417428b6363f389f1762d2a1c03d7a36048a7550da24bd821242d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javadoc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
        • Size 36.3MB
        • SHA256 d318b332d9468c3b8298527d888925a45a99160e72269e8f210150d2921265f5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javafxpackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
        • Size 36.5MB
        • SHA256 8eacf9c2d6f3205a879466631a65b70e21da20b61ebc2fd6c3ecc400fd5e85c2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javah.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
        • Size 36.3MB
        • SHA256 e462cb02dd7eab1aee679b203fba310f8b54653b48b04f65e49b5fafd01511de
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
        • Size 36.3MB
        • SHA256 da1285e3d65017ac2acc9c9dbbe3467fa560514d62d4f22b6c662d55318ac070
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javapackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
        • Size 36.5MB
        • SHA256 deb2f710a2088983a59aac958c5ba0f856aff8cde7975efce8131bcc9334e669
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaw.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
        • Size 36.6MB
        • SHA256 a5266ea27f95f6303681bcb13fb3b227a9e5421b271c192ee26b80d0df6e6fe7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
        • Size 36.8MB
        • SHA256 eada4ad25799a38e8b15bd0dd0e2c029e53eae496676831c404e8fad1737829c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jcmd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
        • Size 36.3MB
        • SHA256 de3d2e41d3c247ea53e39a064df11ea3412e805f16a26b802f13488b55249382
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdb.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
        • Size 36.3MB
        • SHA256 5e5b1b5813eb1940d784949733fabc1b0da5abe5941b3ef3683feb16efce47b0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jinfo.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
        • Size 36.3MB
        • SHA256 cbd2a4505fdd0e3e45df298e7679c6d28a4f4ed1ed80fcabd48636f0def5af68
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jmap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
        • Size 36.3MB
        • SHA256 713df67f1e3ae9d12439c885e559880df2bcce9c0a4823d700da35a692b7efb8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
        • Size 36.3MB
        • SHA256 6de767ef50da874cf7003d2c807bd3e44eb3a6739cab8778f1de715789438e96
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jsadebugd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
        • Size 36.3MB
        • SHA256 9105acbb50df27cf6c3d170b1091b9e45fcdc2d728215b4ae92ec5088c37b492
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstack.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
        • Size 36.3MB
        • SHA256 bf7dfcf6261c9d21b6b74bcb794300ea89483f0a884927ac3eaa6d34c5c41866
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstatd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
        • Size 36.3MB
        • SHA256 913a7bca7ec573a0a3e5bf4616cff6c25febf426a2c244f6bfb9f907ac76e738
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        keytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
        • Size 36.3MB
        • SHA256 479555073d43717608478d8d768496feb404f007752f362bbaac764a420da73e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        kinit.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
        • Size 36.3MB
        • SHA256 a5521750c17fb7991296b7665d9b5f2072e5501042138d44ada355a9a7ad3167
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        klist.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
        • Size 36.3MB
        • SHA256 c4e1b5b6d7c45fd1b50755843d9bf28b0329de72ceff12a683ca35fba2a1e053
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ktab.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
        • Size 36.3MB
        • SHA256 a9f8c74ac10a3f4970ce138f8dd8a3582b4a9c5585692a6120745ae728a06c0c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        native2ascii.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
        • Size 36.3MB
        • SHA256 c6a3a2c000b4fc63625d0a993ad013da7b27b92ccefe90c8133b955b4f755f61
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        orbd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
        • Size 36.3MB
        • SHA256 561b40ddfc3a0de88841c9d6a3b407264e7855e9d7fc7fc66cb6c018287b0458
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
        • Size 36.3MB
        • SHA256 be1b3726975eb3afdc408c6e6874bea4a62c6910276581189c39dd4a32bb629d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        policytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
        • Size 36.3MB
        • SHA256 ca9567b6334091c659e08d03a7988953aef735b0180650a0ea7c66b4d0877ea8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmic.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
        • Size 36.3MB
        • SHA256 5d89307ba656bab055441c446bbda2b6de7b32a17abdd611b4918d5d235b04fa
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmid.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
        • Size 36.3MB
        • SHA256 6d80661efe61a8ff2914617e5621e22778a519b8fcae9947e3617d4b82950f60
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmiregistry.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
        • Size 36.3MB
        • SHA256 9ee856971c867fc58029162153424e07cbd9207f3ffa3e0e4a322647a2281950
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        schemagen.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
        • Size 36.3MB
        • SHA256 da3098905def9261e3e303fd185a6d7714a4e7c5a4f330b4174a41f3fbeea7e3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        serialver.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
        • Size 36.3MB
        • SHA256 81e1dc2cb20cd062bf51df0955bd1596f29ef99743e35e23f009e4fe8597fb2c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dotnet.exe
        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 36.4MB
        • SHA256 1aa91667d396473e2ae5d542f85b7eba69b89356a6b49f1b90f7c2e5798cde2c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 36.4MB
        • SHA256 b812682f648cc9b369a64f47364ef97182f593a2d00d862567ef808894fa27c3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 36.4MB
        • SHA256 57b919aa77052a18dbe7921a39fea297874bdec68db68eaaffa50f791ad3eb8f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 36.4MB
        • SHA256 e5b8ff577392a1fa73cfb87f5e10127c975e159386d8ea9425b606eb0272cd9a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download