Overview

overview

8

Static

static

3

2026-07-01...ar.exe

windows10-2004-x64

8

2026-07-01...ar.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    150s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260629-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    01/07/2026, 13:10

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-07-01_abd800bbb56161589c4628d50b2152a2_cobalt-strike_elex_emotet_glassworm_icedid_njrat_remcos_stealc_vidar.exe
  • Size 7.5MB
  • Sample260701-qectzaez2m
  • SHA256 0807ca418f1fe615cbb8ccff632d437f95bda026553d3e75c1b371923d556a22
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
defense_evasiondiscoverypersistenceransomware

Malware Config

Signatures

  • Drops file in Drivers directory 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Sets desktop wallpaper using registry 2 TTPs 2 IoCs
    ransomware
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies Control Panel 4 IoCs
    defense_evasion
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-07-01_abd800bbb56161589c4628d50b2152a2_cobalt-strike_elex_emotet_glassworm_icedid_njrat_remcos_stealc_vidar.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-07-01_abd800bbb56161589c4628d50b2152a2_cobalt-strike_elex_emotet_glassworm_icedid_njrat_remcos_stealc_vidar.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:3864
  • C:\Users\Admin\AppData\Local\Temp\2026-07-01_abd800bbb56161589c4628d50b2152a2_cobalt-strike_elex_emotet_glassworm_icedid_njrat_remcos_stealc_vidar.exe
    C:\Users\Admin\AppData\Local\Temp/2026-07-01_abd800bbb56161589c4628d50b2152a2_cobalt-strike_elex_emotet_glassworm_icedid_njrat_remcos_stealc_vidar.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:6156

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        7zFM.exe
        • Path C:\Program Files\7-Zip\7zFM.exe
        • Size 8.4MB
        • SHA256 80ab4722875d404c67049bfdf4cbb006467470232fdff903b6b40fd4a6585e2e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        7zG.exe
        • Path C:\Program Files\7-Zip\7zG.exe
        • Size 8.2MB
        • SHA256 66f786b692019f0e1365c9419452c7d53df3a350024a2204423802dd3a4e5a70
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Uninstall.exe
        • Path C:\Program Files\7-Zip\Uninstall.exe
        • Size 15.0MB
        • SHA256 f8206799f38e6a698a6e6bab4483c003b9fbd3da2b7a98a464b597ee34bce570
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        AppVShNotify.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
        • Size 15.3MB
        • SHA256 73ab53aa2c424e3f27d696343c15a4f9ff6a4b5ac44c787448cda94eee22ac41
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        InspectorOfficeGadget.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
        • Size 15.1MB
        • SHA256 52063fe684023072cf2e50ea33992d22c80e688ba93a21d05e843da7e0282f1b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        IntegratedOffice.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
        • Size 19.1MB
        • SHA256 03bc3b9e5cb19831fdb40c697426db604546fcbb97fa80fa8b8f67a5845bfedf
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MavInject32.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
        • Size 15.4MB
        • SHA256 6b09efbd698d086f47bd8f9428f0d5baa23cca99e62c820137aedb133d14db24
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appvcleaner.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
        • Size 9.6MB
        • SHA256 77ca31f1124acf923a63d920df947cdad932dfc42015eab5c15b12a1c9447328
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VSTOInstaller.exe
        • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
        • Size 15.1MB
        • SHA256 b70320a0bfb173284289b944aa9b4bdae37e491802ace8f3162955b0d30fe63c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrmstp.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        • Size 21.1MB
        • SHA256 71561ea2cd8e23940f283f4cc4846fcc0f9e5c7ca7ca86795a2daae8046035f0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_pwa_launcher.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 16.7MB
        • SHA256 843189c31eb04d330c0d4b9ccca3db9501b63618a2b23d778e0737278867fa9d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevated_tracing_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 18.5MB
        • SHA256 acb52f861a555963a9daef02319d588a402fe162a05932209435d239bb177014
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notification_helper.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 16.6MB
        • SHA256 f5c3772609bb863e2d01e0e9709de7c3d492ff365102692a78438d21b4b736e4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 18.1MB
        • SHA256 3a0aa6b0f12f67e50167c5197acc9ec305e716424285887c01ef5727331830fc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_proxy.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 16.4MB
        • SHA256 fd47ea1a24ac713d6dd5eafab7fde9282926d3f731b541751eae58c294774843
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 15.0MB
        • SHA256 aebcc71b4e139670a16bdcaed4ae06807a6684d66c4c9829bc8a7006ec29e8c7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 15.0MB
        • SHA256 8a078ee96b780b1e93dc397c8da0ef09ddabc62fe7ac503594ed3838d42ea9b8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 15.0MB
        • SHA256 3c080566a91a943e46d6a73dc1f8506a220a827b8eaa3858fb002c33620d294a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jar.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 15.0MB
        • SHA256 1941837ea6bf0d3c4f28be641ae01cac202d5e64d7caee360fc8514b0826b4f2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 15.0MB
        • SHA256 59146e545ced4f9bbd01bbcd3a9490eb7e55f1037f449a4627683f09b97d9a83
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javac.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
        • Size 64KB
        • SHA256 5ee579a102ce5bf0cbd0019815419a15a91d52dccc5939636170e988272f403c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javadoc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
        • Size 15.0MB
        • SHA256 c719284f763eec9cc6a7eb57cecf2c667e851ea96657d015301fa8fdb1630585
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javafxpackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
        • Size 15.2MB
        • SHA256 6202dd6102b07cc9da8ed3aa4a2a36c4e02c4ef735618fb473058a7f45f26150
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javah.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
        • Size 15.0MB
        • SHA256 8357d4eb82f0804406eaab2486eb7818403277082c17759c840fc1b5b71ac70b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
        • Size 15.0MB
        • SHA256 4119d6bfad795866555d4d6b6c61daf2c1bfa3931073fd7dae6a71453ba2df22
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javapackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
        • Size 15.2MB
        • SHA256 c215af62a21cb7e6d1e051fde48a3b5e2114e32743a10ef986c52daf4dea0b7d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaw.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
        • Size 15.3MB
        • SHA256 73b3baedf6bf4e8cad654c1fdd1a2da378708cd334ee9090f8aeadcec6e01414
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
        • Size 15.5MB
        • SHA256 2d780eb59d37698ad8fd780cf404a6010d3f2c8df3101883abe2750698e529b3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jcmd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
        • Size 15.0MB
        • SHA256 f6e30dd6c3ef842c370f2195414bdaa583c6ee3f25305d234ced570bcf910860
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jconsole.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
        • Size 15.0MB
        • SHA256 4fe07760da06a840c8cc7bb197ef22a3b413d4929cfc93027ae0cd8eee4dabae
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdeps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
        • Size 15.0MB
        • SHA256 a8329cef0ea7289a6ecd45b5c42a9c30594535c37a1d4fa2d8fe5d2e15040b01
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jhat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
        • Size 15.0MB
        • SHA256 d65401a438cbd17f71a9d97e2c69be1d2f8bcf41beb9f5c49d7f562e3f546388
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jinfo.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
        • Size 15.0MB
        • SHA256 d599bfb9ef9a9906113c74f47c84f008510c5ad42653737de259e0de176207c5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jmap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
        • Size 15.0MB
        • SHA256 d1e8db519da0073c0de9f2af977ab000c20e359066b4491384e2cd70ee1263c1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
        • Size 15.0MB
        • SHA256 008819ed6f4cb364ab4c5af8b284a886f70300933684346e880c6d4377ce6bcb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jrunscript.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
        • Size 15.0MB
        • SHA256 0bdf49c4c8f09ac30fe75c1f5a524ae17d863b4a6d080158be04fbea275363b0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jsadebugd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
        • Size 15.0MB
        • SHA256 e11d1a61283b57fc1e9a214443d2983220b5b0e878281a965f6e4d8afe182300
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstack.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
        • Size 15.0MB
        • SHA256 9d4ef310b59dc8c71853d81f3a14d32f7ab6a8fef1f120fbef2b29486d3ee098
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
        • Size 15.0MB
        • SHA256 a832f83aa682b9048fccb9e0f1e403cee6ed83657d9305dcb4023ec4295b43a7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstatd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
        • Size 15.0MB
        • SHA256 9547e718bbd3a812b670b76a72b81910b75149981ae003ce6da4962e4db381f4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        keytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
        • Size 15.0MB
        • SHA256 79931541a9b7284e2c6f3f351041933b52b9bf42fd2897af902f46df25344c00
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        kinit.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
        • Size 15.0MB
        • SHA256 fce765a2c2f494f009e8011b68e53d286a175bea6b6df039f3c69ba9b7f4268b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        klist.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
        • Size 15.0MB
        • SHA256 afbc4844fc50c8b5d12eee71f551eee7c9a21c717ddb24d7bbcf61a9064303da
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ktab.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
        • Size 15.0MB
        • SHA256 b726c2f042d8a579e0e983ddd13cd0ead7721856fd6d2253fd1f6749ab583d50
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        orbd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
        • Size 15.0MB
        • SHA256 aa39ed0a7ba65ee4663e708a67db748115fc1fa84d0ea11836b465f2129f45dc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
        • Size 15.0MB
        • SHA256 cf5f89862b4d9d1974396ca3b0c72f7646cb5b482abbc421a7a9703daa7b9dcd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        policytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
        • Size 15.0MB
        • SHA256 f3b7d9dce722e24fb7feef3e97355d959cb95e9e4159dded6c013e8162fddb0b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmid.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
        • Size 15.0MB
        • SHA256 59a26cbe0dd102b18bfa0faae9be2b94fbe2bc184edd4c434673ee7f6d72b076
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmiregistry.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
        • Size 15.0MB
        • SHA256 34859297a428577ce09052d49561a7eefb20d440cc4a195cacdad8fe36bffead
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dotnet.exe
        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 15.2MB
        • SHA256 01ebf6c5b53c406de68b1118d3def3a4161c2c123ba672b3e202ad1cf28a83a9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 15.1MB
        • SHA256 e23dab12c27d9bfef14eeb9d9c54f1dbc7ded71a696f922ee8226795c047b774
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 15.1MB
        • SHA256 86f605cc8789dde14478a3e32c6c0696ffc0ccb76acfb73f64cd3d9e0ece49b8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 15.1MB
        • SHA256 8d656dff4fcd277276341b4de708fc655700d65541e1887087bb1dcc35d6f402
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download