Overview

overview

8

Static

static

3

2026-06-30...ar.exe

windows10-2004-x64

8

2026-06-30...ar.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    148s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260629-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    01/07/2026, 04:46

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-06-30_5da66b7ce00add9768e0f6802d146f6f_cobalt-strike_elex_emotet_glassworm_icedid_remcos_vidar.exe
  • Size 6.5MB
  • Sample260701-feey8aew3k
  • SHA256 91af4407025cab9e255480ef6967acee635dc2632501d2d415365f28993bfe62
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
defense_evasiondiscoverypersistenceransomware

Malware Config

Signatures

  • Drops file in Drivers directory 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Sets desktop wallpaper using registry 2 TTPs 2 IoCs
    ransomware
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies Control Panel 4 IoCs
    defense_evasion
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-06-30_5da66b7ce00add9768e0f6802d146f6f_cobalt-strike_elex_emotet_glassworm_icedid_remcos_vidar.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-06-30_5da66b7ce00add9768e0f6802d146f6f_cobalt-strike_elex_emotet_glassworm_icedid_remcos_vidar.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:1220
  • C:\Users\Admin\AppData\Local\Temp\2026-06-30_5da66b7ce00add9768e0f6802d146f6f_cobalt-strike_elex_emotet_glassworm_icedid_remcos_vidar.exe
    C:\Users\Admin\AppData\Local\Temp/2026-06-30_5da66b7ce00add9768e0f6802d146f6f_cobalt-strike_elex_emotet_glassworm_icedid_remcos_vidar.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:5692

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        7zG.exe
        • Path C:\Program Files\7-Zip\7zG.exe
        • Size 7.1MB
        • SHA256 9c9b49f99ff4f3d3d578db6f6d8150b05065f4a12398980581df6993cc8a29aa
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Uninstall.exe
        • Path C:\Program Files\7-Zip\Uninstall.exe
        • Size 12.9MB
        • SHA256 de34074161de6e373d56a50545fbac687f517a66871e864369a637a0bff60a7c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        AppVShNotify.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
        • Size 13.2MB
        • SHA256 e15ef1722657be9484e195255603ce4b33274dceef1fa567d1c9be4f2ac6e0a6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        InspectorOfficeGadget.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
        • Size 13.0MB
        • SHA256 c29573fa6b69a0b7ddde4fdc800307e9acc6ac882313f279ce3bfe3adb17f5da
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        IntegratedOffice.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
        • Size 6.5MB
        • SHA256 91af4407025cab9e255480ef6967acee635dc2632501d2d415365f28993bfe62
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MavInject32.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
        • Size 13.3MB
        • SHA256 a8331aa2dc94abfa9952703ea2d3d1d321c466ac9e9368d53cfc73a8643ef7e2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        OfficeC2RClient.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
        • Size 29.9MB
        • SHA256 124a5e8e59c948a9b2c7a6a718d8a5e39b380a815fd793845007d0e96142c5ec
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appvcleaner.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
        • Size 15.1MB
        • SHA256 90601e3ce379a53b008388fc5a4b466170bff68e266f2dfc4fefc2dce373293f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VSTOInstaller.exe
        • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
        • Size 13.0MB
        • SHA256 8e93a22e220e628a6846e86fc3282de4a816fdb117adda28906abd0f5463e656
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrmstp.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        • Size 19.0MB
        • SHA256 86324064a5a1e275790535dc2b605bc2feb43edfd6680614d0523a603de283b7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_pwa_launcher.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 14.6MB
        • SHA256 0be9ffa4ea88cb7473a9bf7c4bfa3e79fb3dfb39a566943f2dc5728fe8a25dd6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevated_tracing_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 16.4MB
        • SHA256 0537b719485f3b96cfb49a834e7e1372e321c2403c99f879e55c97a52a5681de
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 15.2MB
        • SHA256 1097a378d6997470b7e7a0c03b76305ef24dea2d1b6f67a308f00070e95ba01a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notification_helper.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 14.6MB
        • SHA256 968507c03e507179b54cf02e23ebf860f7fb7fd87296ffc84ef1a5aa7e5a79e9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        os_update_handler.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 14.8MB
        • SHA256 346282b23ff56f2d7110662f22545964bd59acc904ff3121b0ba8aaaf2373ea3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 16.0MB
        • SHA256 fcd1cd1925d536deae95ec91f4d997d251f259e06e739763114efb1985d8d4eb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_proxy.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 14.3MB
        • SHA256 b53b3dd98397687c9c8f2d7cdd1c401230d809cc1b9f6a3704f87a47f398b863
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 12.9MB
        • SHA256 0f9136b7e8dbedf257dfe14053d0a6491e69c363b877221d7f1a55a54b0a6d6c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 12.9MB
        • SHA256 333bef16ede2ef8f8de3e31ae04c8c6a5ea7c3760f56d00a4d4bfce58d7666d2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jar.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 12.9MB
        • SHA256 6fbdfc481bafce1b37a9a866c103f5cbc368913d2553cccf249087b916d5b134
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jarsigner.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        • Size 12.9MB
        • SHA256 1635a38c2169dda1bee3e418ee06d653e939a7b29ab9f656d36b327a4fc3bb44
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
        • Size 13.2MB
        • SHA256 5c99ea8b82baa8ff3fe56ed2fdbf1e787ec89c4a81175e3e489286f7351dcb9b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javac.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
        • Size 12.9MB
        • SHA256 65c6f9b54cea9604918c8c76211412dc25b31121f9bc0859d8cd08d1e8457833
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javadoc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
        • Size 12.9MB
        • SHA256 3904a8443ade1ea17b418f7b87c70523ad0eabd70585a0d6d32e1841e4f117ff
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javafxpackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
        • Size 13.1MB
        • SHA256 52021af7a9dfb831b4cf7cc400f7eb3ea489888609180d1007ace556dc319a74
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javah.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
        • Size 12.9MB
        • SHA256 5fbcca71c9797dddbf06277db35d916b22d754d901435ae8761d47332c6be9fa
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
        • Size 12.9MB
        • SHA256 817f87d750a52cb4b9e40de9071100cffc721148f887092c1ddfcb20f14a21f0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javapackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
        • Size 13.1MB
        • SHA256 524a7d95c38f67baf35517a9844fae1154fbc0cb217d6942c91c8ec6a1334f70
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaw.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
        • Size 13.2MB
        • SHA256 b9ae8046ed560bdea8e3e7784c5d620bb1db32b41a0656915077014b843110c0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
        • Size 13.4MB
        • SHA256 4915aa845d793f842c96b018995ec3594ec22a123d1e1bc670d1295b563374c2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jconsole.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
        • Size 12.9MB
        • SHA256 276020f7f98572f1c41ee90e59a1f5f6526380b49feb22538a39723184c2ae26
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdeps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
        • Size 12.9MB
        • SHA256 fce84dabcf9acd5ab70215874d05990656bf466be11923292c560a3d476476df
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jhat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
        • Size 12.9MB
        • SHA256 32cd5a8f52101a2a1720fb4d52235126f430e010d05a619baf5425e3163c82f4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jjs.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
        • Size 12.9MB
        • SHA256 6fb794903d4e1283df7a768605160b6634fdd51a21430268b08f51d70449da67
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jmap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
        • Size 12.9MB
        • SHA256 0fe03f260b5e080914c8ba271a1047e6f005841047abbba96698095c87919300
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
        • Size 12.9MB
        • SHA256 10fd26f54adffe38fb3de0f253be45cc8306fd9c343f4f4674bd1dcde3f55158
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jrunscript.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
        • Size 12.9MB
        • SHA256 07257e4f4e45b0e55a29440c97b50f5d6ad43be73a0630a7f308851241feef09
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jsadebugd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
        • Size 12.9MB
        • SHA256 366bd94fa4a2e9eb9c1156cf106ad39b7713bb654fb0bbdd9b59fed5be3e748c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstack.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
        • Size 12.9MB
        • SHA256 1a74106e05a6c035e8e475130cc010dd13761b394dab8e73d52ee00bc3f95bc5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
        • Size 12.9MB
        • SHA256 9fe317efce1639bf49daa12d83d82b57b4ac0ca59357c1928381843eba39b795
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstatd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
        • Size 12.9MB
        • SHA256 1c565ee5d46eb061b90753235cc79089a7dc8cab86d3d2c4f29c22b7ffbcf34d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        keytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
        • Size 12.9MB
        • SHA256 350bcd41b5994180f9dd01bcf92fa2693616741bd281425e4fa45d1dd999cfc2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        kinit.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
        • Size 12.9MB
        • SHA256 731a1bfa206efb16a49e025e39bea40bb9268375f7b523272546f0496e746725
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        klist.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
        • Size 12.9MB
        • SHA256 b436b9a6de534fa12abbbed6312b146876522a25a43aa4ec7ac6f121ae953513
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ktab.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
        • Size 12.9MB
        • SHA256 a62120f428c6cdd06c939d934a83d6d3218affc10b6e4af5902c6bb18d29fd08
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        native2ascii.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
        • Size 12.9MB
        • SHA256 b1953e6943c7fb5309f9751d56e4d54daf77aea52f1b625f6b29e881f0a2f1fc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        orbd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
        • Size 12.9MB
        • SHA256 86ccbb6761ee64e6b4a4251efdf47a3b2b7b97a3a8274003701e3b6f0893d2ef
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
        • Size 12.9MB
        • SHA256 82f5e9274559b395bb18ccf4b1b3923be8ccd7908c44750d71d3cb7f23e3e9d4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        policytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
        • Size 12.9MB
        • SHA256 6b24fc88c5a41705722af958cae03aaeb2a1c10bcd8ec952aedebac1b6017752
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmic.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
        • Size 12.9MB
        • SHA256 6e6117b382c9d51a740247ac8b15274a6aceb88a128fd557ef3458f873a0104a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmid.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
        • Size 12.9MB
        • SHA256 396a1f33decf8cc2bb7037d50109ded00459dd92e86ca23c0ec605646a7b7638
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmiregistry.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
        • Size 12.9MB
        • SHA256 6a8bc140cd4d83b237b81fa414ab06c348984ec6006c28d93e13461ef6c686c9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        schemagen.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
        • Size 12.9MB
        • SHA256 e30fda78f816f3e258ffbf64d304708b701d4bd7db0d1eaf59beed63def95893
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dotnet.exe
        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 13.1MB
        • SHA256 9dad97c11da2dcc4696fd91432ad8b51c5c3f2ffcf1e04734ff0f6a06cf87b28
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 13.0MB
        • SHA256 16a76e6c24fcee474ec8ccebf093e798e972b0f65b56640fce37b7f638e12cb1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 13.0MB
        • SHA256 296e25f51d8fdd9f4df0f8b2bfebc0d1a41ff0e8d9ff554d9f5c67d10dbb0605
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 13.0MB
        • SHA256 80630cdd6f14b736375c97396919e6d4f16a3b544d1b3576d50fe44316695610
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download