Overview

overview

8

Static

static

3

2026-07-04...ar.exe

windows10-2004-x64

8

2026-07-04...ar.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    149s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260629-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    04/07/2026, 18:47

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-07-04_5af13290d1d549feac5dabbd7d697a5c_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
  • Size 13.5MB
  • Sample260704-xe98ssb121
  • SHA256 eee572c20c33a0ecc5d2a920bf407cb4f9768570ffa28e4fde539ec47aaeea39
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
defense_evasiondiscoverypersistenceransomware

Malware Config

Signatures

  • Drops file in Drivers directory 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Sets desktop wallpaper using registry 2 TTPs 2 IoCs
    ransomware
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies Control Panel 4 IoCs
    defense_evasion
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-07-04_5af13290d1d549feac5dabbd7d697a5c_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-07-04_5af13290d1d549feac5dabbd7d697a5c_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:3864
  • C:\Users\Admin\AppData\Local\Temp\2026-07-04_5af13290d1d549feac5dabbd7d697a5c_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
    C:\Users\Admin\AppData\Local\Temp/2026-07-04_5af13290d1d549feac5dabbd7d697a5c_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:2672

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        AppVShNotify.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
        • Size 13.8MB
        • SHA256 42b3b5e62edc38ef9b6fa0910ec422fba8cb3d2b3556e6e6ec441c7d78273973
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        InspectorOfficeGadget.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
        • Size 27.1MB
        • SHA256 9df565665a1cbb056ffce4e4d3291911b38b3a4f6c5409b323d91f1f84b61cdf
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        IntegratedOffice.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
        • Size 31.1MB
        • SHA256 74273ba83c343231a03e8310f04cec034272661bd5a731a0a0cdb506a0700cf9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MavInject32.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
        • Size 27.4MB
        • SHA256 fefe9255bbc50d5373201e77bb493aa91121df64c93b24add6356a1f358e7bf0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        OfficeC2RClient.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
        • Size 50.5MB
        • SHA256 44ec57ad6bd339836bf206a28f5674ff833beb6b554e660bb0c8158e5d1d3b37
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appvcleaner.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
        • Size 15.6MB
        • SHA256 9926856a6a5d6ce390979a0b41f3941d2c0afd589d454a46fdcebecebd3ab386
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrmstp.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        • Size 33.1MB
        • SHA256 6999b9cdfa38237f20b86013663ac7d34e93e1b309a465385118c6cf2df4d450
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_pwa_launcher.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 28.8MB
        • SHA256 f6ffae623193fa8c47a09d42c13d9c6a4eda89c4fd3c65f269ef23297402c5e2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 29.3MB
        • SHA256 19dec433af2220c877138453b721064fc44d3274707e43137778e221162e2f6a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notification_helper.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 28.7MB
        • SHA256 65867a91828506bcc75cd27cb3062d50dc38239042644955aacb442e24fa0130
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        os_update_handler.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 28.9MB
        • SHA256 494832d33b9e2efc01d2d45539cc06f0675d0d88b88856f1fc2edad556718fbb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_proxy.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 28.5MB
        • SHA256 f631885a5770f9576482ceffa7101ca90825fd13aa2e0ab2e46094bc1e88b99f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 27.1MB
        • SHA256 8f2211cab984c23d6e1dcab894c3110b7da9bf17e57920346af7e9a81e69275a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 27.1MB
        • SHA256 56e9bb46695d8287dfae64c68c4dedd296393ddd46ecb832e07106dee353a38b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 27.1MB
        • SHA256 630ef1b9cd612099bbb5e3b3959e7491b2ede00f0b014652d3fee3f07c899c66
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 27.1MB
        • SHA256 2294471b39e230f1c4175e3d66980ccb74c883dd06e6bb6172223618f6a19501
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jar.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 27.1MB
        • SHA256 f3e729ae15392e2622265b98bdae7a635044942320ccd608a6e7751670934436
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jarsigner.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        • Size 27.1MB
        • SHA256 e8731f3a3d188646fbd57c4ad302e020e95dccedd31afa6355479be015b398b1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 27.1MB
        • SHA256 313ff2d337dd5b800427240dc22c5cd218f40747efc7033b2907358ae50a3ab3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
        • Size 27.3MB
        • SHA256 ea8a859bb4773cdcf20af7d5f8f828c9e3358577af0e716c59d76b72bcef6ddb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javac.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
        • Size 27.1MB
        • SHA256 0bfecbd156fa69e62f8803781d59866e9261c853841508b383f80f8aea1e4555
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javadoc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
        • Size 27.1MB
        • SHA256 1ddfc5d8972760f473eb5861d8d50fdf61385408d6412678102afc13d555cf18
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javafxpackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
        • Size 27.2MB
        • SHA256 c6e4d25a1b45dc6f912a75657bc3945de86866dd276bdba18cb7bbfe30b14f01
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javah.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
        • Size 27.1MB
        • SHA256 dea31ea23f6dae420579d7add35335411c1a03029c986c9268c51591943d24b4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
        • Size 27.1MB
        • SHA256 07b3ab81a293529662419be588a7c467a62366058366b042005ec55b3b6235cf
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javapackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
        • Size 27.2MB
        • SHA256 c24802aacb2e8733a577f2fd22d89ab4e758ef084bd8a39906df821f02dbfe98
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaw.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
        • Size 27.3MB
        • SHA256 3c8135c3f093c5b8bf66ed46a87ce4930fdaf3378efe33ac5ab97bbc8fe8144a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
        • Size 27.5MB
        • SHA256 13c88cf66475ed5e3ab70c8e30c5e3a584bbb5fdf9428583bf412a7bcf273323
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jcmd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
        • Size 27.1MB
        • SHA256 a4bdebdf4a287c7455b1497eea26c360cbb6e93733173c20b3d7b14230313d2f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jconsole.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
        • Size 27.1MB
        • SHA256 2fe96df3303b2a196e2e9f62220a0ed087814f7bc85ddc4ebb8b65da8703b0ce
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdb.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
        • Size 27.1MB
        • SHA256 1cd7b33bb61ede00d475771d83992af1731e07476b75d4c65f4c3f1cfad48e23
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdeps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
        • Size 27.1MB
        • SHA256 491c4ec3b835d41ed910cd3718e0fa9e63cb5925fb4ae7509e828ec7c4592b0c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jhat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
        • Size 27.1MB
        • SHA256 201e651dea2daed0e051c393e80d36e725b0357dc2adc26fb03e6ed1e442dc86
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jinfo.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
        • Size 27.1MB
        • SHA256 2a3f72ca3e6478a3890736a83a41c50a900b0ff07b138406e3be798c149ff77b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jjs.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
        • Size 27.1MB
        • SHA256 df412de06e84721e5c27703e648843896c92699c33db8f3f6e6979145f043df9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jmap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
        • Size 27.1MB
        • SHA256 a3d215552631c089ad209a70d95d7d5f791315578f8956e9d6cc92c0a8bb4101
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
        • Size 27.1MB
        • SHA256 5a7592346b304f7fcf9082196c246c3bd9c81fbda60c579d1dfa5af0143d787c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jrunscript.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
        • Size 27.1MB
        • SHA256 7aac992d71f30acb4d7df4eb3591f4442f81a0918db7b64ef4337321141d340e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jsadebugd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
        • Size 27.1MB
        • SHA256 6b5fc506e989fb13596a593c95c4d6850e856d4b62eb58083b95bca9d1ee1172
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstack.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
        • Size 27.1MB
        • SHA256 3a3bd71a0b9d96de2ce5d1071dc0181bb023374c30b6a40255b9428647faf093
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
        • Size 27.1MB
        • SHA256 71b213c44724ed7e5e0002846f3deff703b5352ddb626e681154b111804ee7dd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstatd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
        • Size 27.1MB
        • SHA256 3eb59a6a10ef0aa1692154052569118802c6af58df21447b1012b6bdc243c5b5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        keytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
        • Size 27.1MB
        • SHA256 7893c58991e2d4f5f5632a85e7dc49440fcb6c0401f7ef79f118e60320ba52a7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        kinit.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
        • Size 27.1MB
        • SHA256 0d57ce811584e9b8f8a5b4cfcbd250b39ce8518654697694544d25c234d2c9ff
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        klist.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
        • Size 27.1MB
        • SHA256 0192af7855659888f98adecf59103b34660f328e600ae2726b90df37d793adf4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ktab.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
        • Size 27.1MB
        • SHA256 f70925d37ad349d19482bc4180e8d161dfe2235eb21a0fa010a2694ba02970e2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        native2ascii.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
        • Size 27.1MB
        • SHA256 34d8ee8eebd99178bd309d8157291820d716be4ac524c6c03d666e5a2c9bdcb4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        orbd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
        • Size 27.1MB
        • SHA256 6745f55dd9ef3b08dd32c66d7f9e7a4268e9f79806a399f6e7b7240744139819
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
        • Size 27.1MB
        • SHA256 6beabbeabc04e51a4066665d2fa6a87eecaab1d336936793febf71fda53fea71
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        policytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
        • Size 27.1MB
        • SHA256 2aebdbbfa9fbe20b21bd2eef518a816456d3b2bcf250b8a1542f10167180c5c9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmic.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
        • Size 27.1MB
        • SHA256 802cadad2d0b82dcd85512c4ba0515f0480787dd5f8208a6c6d76ff1dec8f29d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmid.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
        • Size 27.1MB
        • SHA256 e67cee7e2e5f0704fd21bb60e8c3efd20b6a15d6ee9c46cda8fe85d8cefd62fb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmiregistry.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
        • Size 27.1MB
        • SHA256 713c86b1203150638b52548e4e11103823c3de769f48a19c678172f6f1a82bad
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        schemagen.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
        • Size 27.1MB
        • SHA256 fc66cfa9e9d0255eeb3d9d0c07f315adfe0425130311043183ab2ca2e73db4c6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        serialver.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
        • Size 27.1MB
        • SHA256 4b6907364e659f85a87c482718c8916573b8adc60804d55f36a01b8522b5fcd6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        servertool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
        • Size 27.1MB
        • SHA256 3f42114ae0b23316da2c31231367bc3dd28585b55f2b7920c1d67fc6fe8704b3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        tnameserv.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
        • Size 27.1MB
        • SHA256 3ae85c3de2c3813459f100cb1559dba2725cff616df2e234d9dda4c6d666f297
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 27.1MB
        • SHA256 87625a2febab8f93e93227d50385a03583c81dccc20eee4d455af1f55c03ed36
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 27.1MB
        • SHA256 740581392fcd5ec7702577f266c87b7bfdf931172d94116b4f3b2e2bd32d3a1e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download