Overview

overview

8

Static

static

3

2026-06-30...ar.exe

windows10-2004-x64

8

2026-06-30...ar.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    149s
  • max time network
    139s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260513-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    01/07/2026, 04:46

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-06-30_5da66b7ce00add9768e0f6802d146f6f_cobalt-strike_elex_emotet_glassworm_icedid_remcos_vidar.exe
  • Size 6.5MB
  • Sample260701-feey8aew3k
  • SHA256 91af4407025cab9e255480ef6967acee635dc2632501d2d415365f28993bfe62
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
defense_evasiondiscoverypersistenceransomware

Malware Config

Signatures

  • Drops file in Drivers directory 3 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Sets desktop wallpaper using registry 2 TTPs 2 IoCs
    ransomware
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies Control Panel 4 IoCs
    defense_evasion
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-06-30_5da66b7ce00add9768e0f6802d146f6f_cobalt-strike_elex_emotet_glassworm_icedid_remcos_vidar.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-06-30_5da66b7ce00add9768e0f6802d146f6f_cobalt-strike_elex_emotet_glassworm_icedid_remcos_vidar.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:4644
  • C:\Users\Admin\AppData\Local\Temp\2026-06-30_5da66b7ce00add9768e0f6802d146f6f_cobalt-strike_elex_emotet_glassworm_icedid_remcos_vidar.exe
    C:\Users\Admin\AppData\Local\Temp/2026-06-30_5da66b7ce00add9768e0f6802d146f6f_cobalt-strike_elex_emotet_glassworm_icedid_remcos_vidar.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:3596

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        7zFM.exe
        • Path C:\Program Files\7-Zip\7zFM.exe
        • Size 7.4MB
        • SHA256 659933f0efdd6f4d73dd6d25c55edf2280e3835043bf248c388840098b5538b0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MavInject32.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
        • Size 6.8MB
        • SHA256 1aa62d91bdd4534347ac2e53fd96bb785cdd3d999a55a62131456efa6c0a9865
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appvcleaner.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
        • Size 8.6MB
        • SHA256 ae09a74f4190f47886fdb44232a2c20b3bb1497b43feea51736c5ea41ac43f04
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 6.5MB
        • SHA256 0c43924fb7b34fffe91fda39fd8cc25dacd5587cf8c4e3e1a499b3a2e93d1b4d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 6.5MB
        • SHA256 8cdb6aef9fac78bca858f85b67c0ad66b5d6f12db5a7a06bc2ec6480d15987f1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 6.5MB
        • SHA256 85d87106d0ecb8375279c8e80dc91bdce8c2dad7a31d46c47377697723965a56
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        native2ascii.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
        • Size 6.5MB
        • SHA256 2c39ad573e82e71b8c51019901ae405d1e61adaf40eefc0c7d3f831613b6ed37
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        orbd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
        • Size 6.5MB
        • SHA256 aa7c4530d89980cc8af0fbe2d5778e60a5d1dd0706098d47cf6786527e93623d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        policytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
        • Size 12.9MB
        • SHA256 6b24fc88c5a41705722af958cae03aaeb2a1c10bcd8ec952aedebac1b6017752
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmic.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
        • Size 12.9MB
        • SHA256 6e6117b382c9d51a740247ac8b15274a6aceb88a128fd557ef3458f873a0104a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmid.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
        • Size 12.9MB
        • SHA256 396a1f33decf8cc2bb7037d50109ded00459dd92e86ca23c0ec605646a7b7638
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmiregistry.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
        • Size 12.9MB
        • SHA256 6a8bc140cd4d83b237b81fa414ab06c348984ec6006c28d93e13461ef6c686c9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        schemagen.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
        • Size 12.9MB
        • SHA256 e30fda78f816f3e258ffbf64d304708b701d4bd7db0d1eaf59beed63def95893
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        serialver.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
        • Size 12.9MB
        • SHA256 6b7d5ae0f6b03d2f2833f50afa8b89bd3899370cb190d2d00c45fe79be1e489b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        servertool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
        • Size 12.9MB
        • SHA256 f364391119f3f76666cfc197d6ce6d841d2b831c843bc01eba25b04d6d6f8cd3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        tnameserv.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
        • Size 12.9MB
        • SHA256 f4d2d62903be8b31d2c275b8067d60278b6466370e9b59c33e7aacdd015635df
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        unpack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\unpack200.exe
        • Size 13.1MB
        • SHA256 6fe26dc248f2e169aaa334922650ce1f58dd89d914a40aab84addf583ea59cf4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        wsgen.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
        • Size 12.9MB
        • SHA256 3f58dc13b8c5dca6d0ee295ff2eba42983798dbc4257e5472b8b3914e95cdc00
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        wsimport.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
        • Size 12.9MB
        • SHA256 211d2a2766eb74b66e3f598ae2faa93781e32613cd89a3f2df723c8b6d70cef8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        xjc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
        • Size 12.9MB
        • SHA256 46b2cf45b3109e0911883733a2fb352d417860782ab448d14b15f41582c44faf
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe
        • Size 13.0MB
        • SHA256 5c1028c4f53cd982d1b54768637e95ce3056993b7d4e378617294897f6e0ff04
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe
        • Size 12.9MB
        • SHA256 3d191423e285b7a1439246c1b68fca7c3d61fc5872dce76e8480d17201ed3e37
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\java.exe
        • Size 13.2MB
        • SHA256 d4b5cc85c026df00aad219bf9b4ad0f719a015360b631eecce2be01202987d93
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javacpl.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe
        • Size 13.0MB
        • SHA256 5b564cdb4f817e76080fd30887018a8fb725c233229606902cc25ab92a734d0c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaw.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe
        • Size 13.2MB
        • SHA256 a7585d720ee629eecefb2b15eb2bd1e1e155efcd090a6778716529428b1c8f8f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe
        • Size 13.4MB
        • SHA256 68c5ebbaa6250f6e0973bd1d2d7da873b7ead12c18ae0a8979d0f8c7fbbc75a1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jjs.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe
        • Size 12.9MB
        • SHA256 ea69d7e602fba7f8ce287f81bce410af9c7365dcd357d6a4033a51d6b1a4d618
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jp2launcher.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe
        • Size 13.1MB
        • SHA256 f8337694ba00d559bb3f50982e36fc5b3f2ea5405d9804b91d67e15776009876
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        keytool.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe
        • Size 12.9MB
        • SHA256 bfeb5d62d618ba143f99a1335dd34283179e9846407e46117e9b224d1bc9a212
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        kinit.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe
        • Size 12.9MB
        • SHA256 33b27cce94da1b565a35ec45f680b6208725198848723ed77067c50b9d2fea3e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        klist.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe
        • Size 12.9MB
        • SHA256 ea54af8699da2862f99a9fc8fe320795df763e869e4a9f513e959e8882891fb1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ktab.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe
        • Size 12.9MB
        • SHA256 1bcd046e97f4932c9f98acc8acb5d69eaf7796b4c2be0ef231430f32dc6bfd9d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        orbd.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe
        • Size 12.9MB
        • SHA256 67fe0fc9e50b10efdaf8ce22d7b4b3526190c6a9b1bc0ded3889712e9eaa03fe
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pack200.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe
        • Size 12.9MB
        • SHA256 01265af417d325b01dd7b720f7a7f4ac95fff40b2a67dc76048182432e76999c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        policytool.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe
        • Size 12.9MB
        • SHA256 d9cbf568e10614388e57339c5d4103c4299c118c00181a88b1771fbc3b239ff5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmid.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe
        • Size 12.9MB
        • SHA256 2efbd429f80f92d9b4e46657ecf1c17884bb643c4142ac32449b511711f90e81
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmiregistry.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe
        • Size 12.9MB
        • SHA256 7c85f5c5d4c8bb75191cd58f382c640ba72aa25fe4473a32224b4095502e625f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        servertool.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe
        • Size 12.9MB
        • SHA256 b3c338faa3275180c8d23783d1706ff777de8270057d274d9a6f678f82c5e0e4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ssvagent.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe
        • Size 13.0MB
        • SHA256 7021838baa4d1ebe73732fbcdc3a87ac9181f994f32e1fa8f52d8ca447a3348a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        tnameserv.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe
        • Size 12.9MB
        • SHA256 48d8ad8a9a49b2814d1a7d170d9bc2cacada75eeba6ad413fe9e1bfef0fb5b31
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        unpack200.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe
        • Size 13.1MB
        • SHA256 26ade6b38376f804ae236e083bd404a5fb4f1b8a198e98eda81bb6108097d48e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        fontconfig.properties.src
        • Path C:\Program Files\Java\jdk-1.8\jre\lib\fontconfig.properties.src
        • Size 12.9MB
        • SHA256 9bf86c0d86350e70bc53f5af391cd18fb4008a43f0e47407ae5d447360819a90
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jre-1.8\bin\jabswitch.exe
        • Size 13.0MB
        • SHA256 7b39269005b0e79f6658de8e833f2128132c84a26ac89cb20f1e37dccd0e9bba
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jre-1.8\bin\java-rmi.exe
        • Size 12.9MB
        • SHA256 0e1ab26053a7b2320b103390a17586fedc0b5356eb2984088bce8a31aa2e4b52
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jre-1.8\bin\java.exe
        • Size 13.2MB
        • SHA256 7f3c829378931fb3d74a45f131c209667d5b9fbeef2019b74724680925fab30e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaw.exe
        • Path C:\Program Files\Java\jre-1.8\bin\javaw.exe
        • Size 13.2MB
        • SHA256 6f7bee8fe906f46aad672eafe967df05b6dbee67433df7dac8fe2bfbcbf3ddd0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jjs.exe
        • Path C:\Program Files\Java\jre-1.8\bin\jjs.exe
        • Size 12.9MB
        • SHA256 58cd0ad4a7f161eaca9f784d7b3bbf272d57425f1c0c4af1af0b8e2c3acb8477
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jp2launcher.exe
        • Path C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe
        • Size 13.1MB
        • SHA256 ef4dde636e288dce8851eb29c13703569ba289bb910244c53efa9003dfd4f67b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        kinit.exe
        • Path C:\Program Files\Java\jre-1.8\bin\kinit.exe
        • Size 12.9MB
        • SHA256 6f704f1ec588d7b937efca923d72be00a87316f77ed0f7dbb9a6d853de1cd3e1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        klist.exe
        • Path C:\Program Files\Java\jre-1.8\bin\klist.exe
        • Size 12.9MB
        • SHA256 00cffe8d36d19351e77e9b82c00f4a2199ae469cb7760ccd779993bd048b1a35
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ktab.exe
        • Path C:\Program Files\Java\jre-1.8\bin\ktab.exe
        • Size 12.9MB
        • SHA256 1b2f840439e1314bec1bc65e3441b93b02a06ff9f9c6eed3616674cb8a287c1b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        orbd.exe
        • Path C:\Program Files\Java\jre-1.8\bin\orbd.exe
        • Size 12.9MB
        • SHA256 b4e91a440355041ccc82a365ef0ae79a4207acc5544a304a2c3f01168ba3c90e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pack200.exe
        • Path C:\Program Files\Java\jre-1.8\bin\pack200.exe
        • Size 12.9MB
        • SHA256 1e67ae23d44132d0394ac5116c7d8ba7b479404b9311ee6a0ba8ed6060f45b43
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        policytool.exe
        • Path C:\Program Files\Java\jre-1.8\bin\policytool.exe
        • Size 12.9MB
        • SHA256 5e03443cdb463fc81f660bbe8af962328047e56185e132d185ee82c88d07b085
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmid.exe
        • Path C:\Program Files\Java\jre-1.8\bin\rmid.exe
        • Size 12.9MB
        • SHA256 361a2c0cdbd45674c19e54940b157ecf3a7b323118a339aa06ec2b402734ef89
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmiregistry.exe
        • Path C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe
        • Size 12.9MB
        • SHA256 ca7fb7b4764bdd81bfb353ec29be8dded9834b05e60b441354a0b7260ed27851
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        spo0lve.exe
        • Path C:\windows\SysWOW64\drivers\spo0lve.exe
        • Size 6.5MB
        • SHA256 91af4407025cab9e255480ef6967acee635dc2632501d2d415365f28993bfe62
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download