Overview

overview

8

Static

static

3

2026-07-01...ar.exe

windows10-2004-x64

8

2026-07-01...ar.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    149s
  • max time network
    124s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260629-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    01/07/2026, 15:06

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-07-01_94a530083d0e8ae213450df13ecb966b_cobalt-strike_elex_emotet_glassworm_hijackloader_icedid_remcos_vidar.exe
  • Size 13.0MB
  • Sample260701-sg43cagy2k
  • SHA256 515b885419b5f231ec2431db01d369697f61ef3396c160e5bf878dbd24800695
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
defense_evasiondiscoverypersistenceransomware

Malware Config

Signatures

  • Drops file in Drivers directory 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Sets desktop wallpaper using registry 2 TTPs 2 IoCs
    ransomware
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies Control Panel 4 IoCs
    defense_evasion
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-07-01_94a530083d0e8ae213450df13ecb966b_cobalt-strike_elex_emotet_glassworm_hijackloader_icedid_remcos_vidar.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-07-01_94a530083d0e8ae213450df13ecb966b_cobalt-strike_elex_emotet_glassworm_hijackloader_icedid_remcos_vidar.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:6948
  • C:\Users\Admin\AppData\Local\Temp\2026-07-01_94a530083d0e8ae213450df13ecb966b_cobalt-strike_elex_emotet_glassworm_hijackloader_icedid_remcos_vidar.exe
    C:\Users\Admin\AppData\Local\Temp/2026-07-01_94a530083d0e8ae213450df13ecb966b_cobalt-strike_elex_emotet_glassworm_hijackloader_icedid_remcos_vidar.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:6524

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        7z.exe
        • Path C:\Program Files\7-Zip\7z.exe
        • Size 13.5MB
        • SHA256 2466e8915cdf571a1641bef4d8829e810ac053fcc5d2bd54a4269fdd282a8501
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        7zFM.exe
        • Path C:\Program Files\7-Zip\7zFM.exe
        • Size 13.9MB
        • SHA256 19a15f2d02a77e2768ebad3e3c65dad76239d6f25731af4a4a3c4e4fa526b31f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        7zG.exe
        • Path C:\Program Files\7-Zip\7zG.exe
        • Size 13.7MB
        • SHA256 52986eddb531c6ee8b6b86da68c71a7ed1e841f7e25d2a3185d0ba9121c505d4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Uninstall.exe
        • Path C:\Program Files\7-Zip\Uninstall.exe
        • Size 13.0MB
        • SHA256 61904c6e97a8d7685f2634c817d8d3acd99ec90704306e836c08c7482093f32f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        AppVShNotify.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
        • Size 26.2MB
        • SHA256 bb400246a5a890dac634f72bde248e5b670f90c2eabd50e014b3bc44bf712c82
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        InspectorOfficeGadget.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
        • Size 26.0MB
        • SHA256 5559ba4d060de510991c17edb17dc21005ea702e21e210b87176523769bef129
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        IntegratedOffice.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
        • Size 30.1MB
        • SHA256 b1bf9a3c4cc7c2e931fc4660dbd55c2564f7c63f515ae740563853223453f901
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MavInject32.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
        • Size 26.3MB
        • SHA256 99f51ae275fb7dfd7a5de6de7a2e32f632e67d32c5230c69f115aebb95c1b101
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        OfficeC2RClient.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
        • Size 576KB
        • SHA256 75c7e791b87adf1ec05a04ce2dc7bb2b4a82a6db882cea23eba5e17e5cda2bd1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appvcleaner.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
        • Size 15.1MB
        • SHA256 74736abcc06588b458f644f8675d1fafc2797324bb0551c1cceb6b4d0130b331
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VSTOInstaller.exe
        • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
        • Size 26.1MB
        • SHA256 2cb3d193f1ede446e61e83608c5e894179431664fed85fe2f5988219a1458b84
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        setup.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
        • Size 32.0MB
        • SHA256 cf0ce5b6648634231f77829ba3232654adfc0d8b919c79aea927cca7de7ada7e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_pwa_launcher.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 27.7MB
        • SHA256 ded0315cbf3783b096a2efc4f02a76e17ca485ea08bb716eaa3506b3639f96c3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevated_tracing_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 29.4MB
        • SHA256 b021fcdcbf405d187a4feef3182ea26637e74a21badb3e3038fe08f5ccc85fdb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 28.2MB
        • SHA256 9c57c212d3bdf1cc252cebec517a99c8b30317a98594de706d95257ab8f2412f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notification_helper.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 27.6MB
        • SHA256 b4741a2394f9f21a6447c75e75b4a7705c18712aad6504f892295d97dcf68705
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        os_update_handler.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 27.8MB
        • SHA256 21e825b447d16d8bd1f0376be19aac95dfa40d2bf98a448bdf72b55cdc8b1fe2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 29.0MB
        • SHA256 1b6fce39bec96c1a80c6d22a970dc1a7a6dbb3ab997ae930be2c7ff0e5ab3790
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_proxy.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 27.4MB
        • SHA256 7349b1dfa379a5f830ae55116fc6811d7881421d09d576e74883bf8d6fe9a581
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 26.0MB
        • SHA256 cf1f6d3c5a8bf971fb09f3ee55603e817d6f73ae4705fd5039f90f3ed6067bb9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 26.0MB
        • SHA256 1263c6444be96db1d0552a4cc9740dde7c812fa68a92aeaedb2a38f0964cfc29
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 13.0MB
        • SHA256 b777b8f6f6188e4e42a5efa9921b8fb8d6d804778b653305104ed4f0c70df08d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jarsigner.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        • Size 26.0MB
        • SHA256 951186c30299b1ec9f83834e30ccf6cd4c9445595b0748f15e821e6dd3e71860
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
        • Size 26.3MB
        • SHA256 5bf2a5e3652a5f4a4217c3f86e19f5822327ddcc424cf156dfd431e94d591583
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javafxpackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
        • Size 26.1MB
        • SHA256 4d8b5d81e4e117db0be4066f3c10a9f8b9e4dbb24b65d8537d767d1656cbc577
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javah.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
        • Size 26.0MB
        • SHA256 1568a84e4c3cd502bb78530aff40c79e435888e9fafd4916c7fe0adc536cb19d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
        • Size 26.0MB
        • SHA256 a90280ac2d5071540ffafdd4f7bb2e4013fa7f030ee2ca0a336aa2a8635aae35
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javapackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
        • Size 26.1MB
        • SHA256 3f683f4dcc332e494efed09d5c14261d8573e662b83a61ef49999e7139c91c8f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
        • Size 26.4MB
        • SHA256 0bea5493d336900e010a6cd88b886b3d3146406f075d3dcfa77bbe9bdf7970de
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdeps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
        • Size 26.0MB
        • SHA256 d5e47f6caacd82a702ae8446a05be268c7b3088427145f5fbace5b230a28552b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jhat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
        • Size 26.0MB
        • SHA256 9d944e77a29838cc5ee1428234085d77642a556ef8c186285b51150ce1fc1cce
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jmap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
        • Size 26.0MB
        • SHA256 0c68e42010682e958481c10ada42ebbda78fd48b233b864b8a0732ed4e020954
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
        • Size 26.0MB
        • SHA256 386a2deb9e5c8a4a724671557237dec062c4e713e6eb2046e71ad1f266023127
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jrunscript.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
        • Size 26.0MB
        • SHA256 77c439a4b107b91001835292a47430653831ab688d13a72069405193012709da
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstack.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
        • Size 26.0MB
        • SHA256 665269928507fdfeef6998d5bcdc8ff26a713435e728054b5f85f1ea1c0536c8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstatd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
        • Size 26.0MB
        • SHA256 24bc7aa6f8a86dcc70bffa2ef4a24d87b86fd7903edcfa20b2305d74a22d8000
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
        • Size 26.0MB
        • SHA256 9bd79ae08e67ee670a0bbc8827b945a0ad63eab9ae27ca05ab5f33b121f1d407
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmid.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
        • Size 26.0MB
        • SHA256 3911daedcb39e7d9d76313378d6e26b5933bbf123b93e34bc0437e5c11a8110e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmiregistry.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
        • Size 26.0MB
        • SHA256 1f4d4ace3eea650e13d4c68b86a3a2b301678c8f59d7e59875848cabf4205400
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dotnet.exe
        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 26.1MB
        • SHA256 f94adf301797495d5e87bd7d01f6aea48075371a65f84afcfb18100e69865d49
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 26.0MB
        • SHA256 cffceee3fbb2e9188693a35d04d76ab3782764806f5d27a2db72e83525b9bef0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 26.0MB
        • SHA256 30ad40ff0f41c98219b7aa6487a4f6e7bcd45a1a337923ba4fb4c830577049ec
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 26.0MB
        • SHA256 a37c9d8939d332e43dcc0934a0ba00047585bad2b6a302bec42c36feae6fc8b4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download