Overview

overview

8

Static

static

3

2026-07-01...ar.exe

windows10-2004-x64

8

2026-07-01...ar.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    150s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260513-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    01/07/2026, 13:10

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-07-01_abd800bbb56161589c4628d50b2152a2_cobalt-strike_elex_emotet_glassworm_icedid_njrat_remcos_stealc_vidar.exe
  • Size 7.5MB
  • Sample260701-qectzaez2m
  • SHA256 0807ca418f1fe615cbb8ccff632d437f95bda026553d3e75c1b371923d556a22
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
defense_evasiondiscoverypersistenceransomware

Malware Config

Signatures

  • Drops file in Drivers directory 3 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Sets desktop wallpaper using registry 2 TTPs 2 IoCs
    ransomware
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies Control Panel 4 IoCs
    defense_evasion
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-07-01_abd800bbb56161589c4628d50b2152a2_cobalt-strike_elex_emotet_glassworm_icedid_njrat_remcos_stealc_vidar.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-07-01_abd800bbb56161589c4628d50b2152a2_cobalt-strike_elex_emotet_glassworm_icedid_njrat_remcos_stealc_vidar.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:2096
  • C:\Users\Admin\AppData\Local\Temp\2026-07-01_abd800bbb56161589c4628d50b2152a2_cobalt-strike_elex_emotet_glassworm_icedid_njrat_remcos_stealc_vidar.exe
    C:\Users\Admin\AppData\Local\Temp/2026-07-01_abd800bbb56161589c4628d50b2152a2_cobalt-strike_elex_emotet_glassworm_icedid_njrat_remcos_stealc_vidar.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:3760

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        7z.exe
        • Path C:\Program Files\7-Zip\7z.exe
        • Size 15.6MB
        • SHA256 c4468a2265b111766004d0b28735c69cf2dbc107ed9d92ebca68fbab67b51d30
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        7zFM.exe
        • Path C:\Program Files\7-Zip\7zFM.exe
        • Size 16.0MB
        • SHA256 645f59c80456593185e068dcddcbe113bb98329de71a42309a6b0b495846a376
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        7zG.exe
        • Path C:\Program Files\7-Zip\7zG.exe
        • Size 15.7MB
        • SHA256 cf29fdb9d774f6a8d97c96c10f8ce3235e4c452ea983963b3e8f019353fc28a7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Uninstall.exe
        • Path C:\Program Files\7-Zip\Uninstall.exe
        • Size 15.0MB
        • SHA256 f8206799f38e6a698a6e6bab4483c003b9fbd3da2b7a98a464b597ee34bce570
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        AppVShNotify.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
        • Size 15.3MB
        • SHA256 73ab53aa2c424e3f27d696343c15a4f9ff6a4b5ac44c787448cda94eee22ac41
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        InspectorOfficeGadget.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
        • Size 15.1MB
        • SHA256 52063fe684023072cf2e50ea33992d22c80e688ba93a21d05e843da7e0282f1b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        IntegratedOffice.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
        • Size 19.1MB
        • SHA256 03bc3b9e5cb19831fdb40c697426db604546fcbb97fa80fa8b8f67a5845bfedf
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MavInject32.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
        • Size 15.4MB
        • SHA256 6b09efbd698d086f47bd8f9428f0d5baa23cca99e62c820137aedb133d14db24
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        OfficeC2RClient.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
        • Size 38.5MB
        • SHA256 0318ce798d6641feebef55b258903badc2e5280e08a5c5ee49279b82c804ec38
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appvcleaner.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
        • Size 17.1MB
        • SHA256 d79af4bd92a2155a7b07229d2c0f5c7adb3299ee576b214356c4799cf523b8d5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VSTOInstaller.exe
        • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
        • Size 15.1MB
        • SHA256 b70320a0bfb173284289b944aa9b4bdae37e491802ace8f3162955b0d30fe63c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrmstp.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        • Size 21.1MB
        • SHA256 71561ea2cd8e23940f283f4cc4846fcc0f9e5c7ca7ca86795a2daae8046035f0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_pwa_launcher.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 16.7MB
        • SHA256 843189c31eb04d330c0d4b9ccca3db9501b63618a2b23d778e0737278867fa9d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevated_tracing_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 18.5MB
        • SHA256 acb52f861a555963a9daef02319d588a402fe162a05932209435d239bb177014
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 17.3MB
        • SHA256 c5879d99112fce1883dc674cf206704827cdc64ff761dde0b04b2610837f606e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notification_helper.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 16.6MB
        • SHA256 f5c3772609bb863e2d01e0e9709de7c3d492ff365102692a78438d21b4b736e4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        os_update_handler.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 16.9MB
        • SHA256 8a0f282301aa4f17cbdd6883732c591c9d35c18535a45b98b54353a2aae71292
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 18.1MB
        • SHA256 3a0aa6b0f12f67e50167c5197acc9ec305e716424285887c01ef5727331830fc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_proxy.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 16.4MB
        • SHA256 fd47ea1a24ac713d6dd5eafab7fde9282926d3f731b541751eae58c294774843
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 15.0MB
        • SHA256 aebcc71b4e139670a16bdcaed4ae06807a6684d66c4c9829bc8a7006ec29e8c7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 15.0MB
        • SHA256 8a078ee96b780b1e93dc397c8da0ef09ddabc62fe7ac503594ed3838d42ea9b8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 15.0MB
        • SHA256 3c080566a91a943e46d6a73dc1f8506a220a827b8eaa3858fb002c33620d294a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 15.1MB
        • SHA256 b1601887a936e53bca35f725246543312f20a0b99e8689beae6e45b131eedb14
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jar.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 15.0MB
        • SHA256 1941837ea6bf0d3c4f28be641ae01cac202d5e64d7caee360fc8514b0826b4f2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jarsigner.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        • Size 15.0MB
        • SHA256 27c6441a718aefd0a0f5dafcddcd821b05b70bad3f4f90c058b06984a29d1698
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 15.0MB
        • SHA256 59146e545ced4f9bbd01bbcd3a9490eb7e55f1037f449a4627683f09b97d9a83
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
        • Size 15.3MB
        • SHA256 30c3f70ab1d9a976512d23c271089008d15966e826bae2c287b91b3662756322
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javac.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
        • Size 15.0MB
        • SHA256 5653387f66d89f9dccad5fafbcc31c2277b67196f21273fcfe6b51ceb4a87423
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javadoc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
        • Size 15.0MB
        • SHA256 c719284f763eec9cc6a7eb57cecf2c667e851ea96657d015301fa8fdb1630585
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javafxpackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
        • Size 15.2MB
        • SHA256 6202dd6102b07cc9da8ed3aa4a2a36c4e02c4ef735618fb473058a7f45f26150
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javah.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
        • Size 15.0MB
        • SHA256 8357d4eb82f0804406eaab2486eb7818403277082c17759c840fc1b5b71ac70b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
        • Size 15.0MB
        • SHA256 4119d6bfad795866555d4d6b6c61daf2c1bfa3931073fd7dae6a71453ba2df22
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javapackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
        • Size 15.2MB
        • SHA256 c215af62a21cb7e6d1e051fde48a3b5e2114e32743a10ef986c52daf4dea0b7d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaw.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
        • Size 15.3MB
        • SHA256 73b3baedf6bf4e8cad654c1fdd1a2da378708cd334ee9090f8aeadcec6e01414
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
        • Size 15.5MB
        • SHA256 2d780eb59d37698ad8fd780cf404a6010d3f2c8df3101883abe2750698e529b3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jcmd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
        • Size 15.0MB
        • SHA256 f6e30dd6c3ef842c370f2195414bdaa583c6ee3f25305d234ced570bcf910860
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jconsole.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
        • Size 15.0MB
        • SHA256 4fe07760da06a840c8cc7bb197ef22a3b413d4929cfc93027ae0cd8eee4dabae
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdb.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
        • Size 15.0MB
        • SHA256 a6a058400f9cf09ba6ccf1ddd88d0b9a272a805de6ef29a45c03322ce6fc9db9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdeps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
        • Size 15.0MB
        • SHA256 a8329cef0ea7289a6ecd45b5c42a9c30594535c37a1d4fa2d8fe5d2e15040b01
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jhat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
        • Size 15.0MB
        • SHA256 d65401a438cbd17f71a9d97e2c69be1d2f8bcf41beb9f5c49d7f562e3f546388
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jinfo.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
        • Size 15.0MB
        • SHA256 d599bfb9ef9a9906113c74f47c84f008510c5ad42653737de259e0de176207c5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jjs.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
        • Size 15.0MB
        • SHA256 20886227b5e78f1a9af66b9e3ad94d4e377611b50229f252818648b1e19e9de2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jmap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
        • Size 15.0MB
        • SHA256 d1e8db519da0073c0de9f2af977ab000c20e359066b4491384e2cd70ee1263c1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
        • Size 15.0MB
        • SHA256 008819ed6f4cb364ab4c5af8b284a886f70300933684346e880c6d4377ce6bcb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jrunscript.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
        • Size 15.0MB
        • SHA256 0bdf49c4c8f09ac30fe75c1f5a524ae17d863b4a6d080158be04fbea275363b0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jsadebugd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
        • Size 15.0MB
        • SHA256 e11d1a61283b57fc1e9a214443d2983220b5b0e878281a965f6e4d8afe182300
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstack.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
        • Size 15.0MB
        • SHA256 9d4ef310b59dc8c71853d81f3a14d32f7ab6a8fef1f120fbef2b29486d3ee098
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
        • Size 15.0MB
        • SHA256 a832f83aa682b9048fccb9e0f1e403cee6ed83657d9305dcb4023ec4295b43a7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstatd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
        • Size 15.0MB
        • SHA256 9547e718bbd3a812b670b76a72b81910b75149981ae003ce6da4962e4db381f4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        keytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
        • Size 15.0MB
        • SHA256 79931541a9b7284e2c6f3f351041933b52b9bf42fd2897af902f46df25344c00
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        kinit.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
        • Size 15.0MB
        • SHA256 fce765a2c2f494f009e8011b68e53d286a175bea6b6df039f3c69ba9b7f4268b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        klist.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
        • Size 15.0MB
        • SHA256 afbc4844fc50c8b5d12eee71f551eee7c9a21c717ddb24d7bbcf61a9064303da
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ktab.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
        • Size 15.0MB
        • SHA256 b726c2f042d8a579e0e983ddd13cd0ead7721856fd6d2253fd1f6749ab583d50
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        native2ascii.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
        • Size 15.0MB
        • SHA256 6e674b47bb2b5c8b492174ad6fa224ced7080d30a4a38523766a96fd8dfa5e6f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        orbd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
        • Size 15.0MB
        • SHA256 aa39ed0a7ba65ee4663e708a67db748115fc1fa84d0ea11836b465f2129f45dc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
        • Size 15.0MB
        • SHA256 cf5f89862b4d9d1974396ca3b0c72f7646cb5b482abbc421a7a9703daa7b9dcd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        policytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
        • Size 15.0MB
        • SHA256 f3b7d9dce722e24fb7feef3e97355d959cb95e9e4159dded6c013e8162fddb0b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmic.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
        • Size 15.0MB
        • SHA256 3133041104efbb2abd4c6f63abc62b72f5a53038dfdf1781b5ce70e91c5761ff
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dotnet.exe
        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 15.2MB
        • SHA256 01ebf6c5b53c406de68b1118d3def3a4161c2c123ba672b3e202ad1cf28a83a9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 15.1MB
        • SHA256 e23dab12c27d9bfef14eeb9d9c54f1dbc7ded71a696f922ee8226795c047b774
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 15.1MB
        • SHA256 86f605cc8789dde14478a3e32c6c0696ffc0ccb76acfb73f64cd3d9e0ece49b8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 15.1MB
        • SHA256 8d656dff4fcd277276341b4de708fc655700d65541e1887087bb1dcc35d6f402
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        spo0lve.exe
        • Path C:\windows\SysWOW64\drivers\spo0lve.exe
        • Size 7.5MB
        • SHA256 0807ca418f1fe615cbb8ccff632d437f95bda026553d3e75c1b371923d556a22
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download