Overview

overview

8

Static

static

3

2026-07-05...ar.exe

windows10-2004-x64

8

2026-07-05...ar.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    148s
  • max time network
    141s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260629-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    05/07/2026, 05:13

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-07-05_56693dc4c08507f66c1813d4796035fd_cobalt-strike_elex_emotet_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe
  • Size 13.8MB
  • Sample260705-fwmemadv9p
  • SHA256 2b4753873c2ef77f4c111f476ded83fe9f6a3f2c88789d3a98d5b281e30f1c83
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
defense_evasiondiscoverypersistenceransomware

Malware Config

Signatures

  • Drops file in Drivers directory 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Sets desktop wallpaper using registry 2 TTPs 2 IoCs
    ransomware
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies Control Panel 4 IoCs
    defense_evasion
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-07-05_56693dc4c08507f66c1813d4796035fd_cobalt-strike_elex_emotet_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-07-05_56693dc4c08507f66c1813d4796035fd_cobalt-strike_elex_emotet_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:5144
  • C:\Users\Admin\AppData\Local\Temp\2026-07-05_56693dc4c08507f66c1813d4796035fd_cobalt-strike_elex_emotet_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe
    C:\Users\Admin\AppData\Local\Temp/2026-07-05_56693dc4c08507f66c1813d4796035fd_cobalt-strike_elex_emotet_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:3712

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        7zFM.exe
        • Path C:\Program Files\7-Zip\7zFM.exe
        • Size 14.8MB
        • SHA256 b3e0cb91caeb49556af7b602e7102ac3332f000f91e371aaac69f2f6c63e47b4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        7zG.exe
        • Path C:\Program Files\7-Zip\7zG.exe
        • Size 14.5MB
        • SHA256 072fc63397f7ec57db0c937211530cf913edb8e76d60878357fe34ca7f373b55
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Uninstall.exe
        • Path C:\Program Files\7-Zip\Uninstall.exe
        • Size 27.6MB
        • SHA256 ec37c357654ffd1b7bd0f250b7acfc4d143c47c2b462399041de67acf91cc4ce
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        AppVShNotify.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
        • Size 27.9MB
        • SHA256 020a672418b44446b533a73cca5840aec5eb5b21459f5944d146cdbcf382d847
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        InspectorOfficeGadget.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
        • Size 27.7MB
        • SHA256 f0cafd4dd2e4d3f6f77ebf4413fca83538c5eebbb8c5ed5b40ee0ca9c5dd35dd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        IntegratedOffice.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
        • Size 31.7MB
        • SHA256 1df76d62a4762e18915efe627f8c9e8a8567fb27f8a69fd6de88bd5fd041e4b8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MavInject32.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
        • Size 28.0MB
        • SHA256 0196b5d90ebb09afae3ad86991244771a0f28dd41537e2d331687e5ff234b9f0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appvcleaner.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
        • Size 29.8MB
        • SHA256 6e1f1d58fffed065300da5709258984778ee81f75e1d7c5119efbcbff2152328
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VSTOInstaller.exe
        • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
        • Size 13.9MB
        • SHA256 0b6b9cf998462fd88aaef9991b0aa34224f80b9d09f9ef7b32180709f5546636
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        setup.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
        • Size 33.7MB
        • SHA256 61f069e41f155b63ffe03e280ab093e7c5ccfb6641c97da174ced65228765684
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevated_tracing_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 31.1MB
        • SHA256 a9de8ee9dc1d2d6c9eccdcd3a8b814b72a8666225287e0d050d2de193e57c2d3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 29.9MB
        • SHA256 6ad22fea2f99bf2d4ae1fbe4f1e45892e0a9b50029937ae8615f98b83d63983e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notification_helper.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 29.3MB
        • SHA256 b1e65ad41272cf00fbc47a36d1fcfc5ed65b5bdfaeffbb0e5cd97c7ff958587a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        os_update_handler.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 29.5MB
        • SHA256 7e116084a374ffdbd3d53d3f1c74ae2969c821ec1dedf034d70565c2855bbfd9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 30.7MB
        • SHA256 51728c4d071e97065ac8a5a1d378387fe52ea14aab463f0991ca55ac5e82f42f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_proxy.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 29.0MB
        • SHA256 c24cd35efb43f696665970ae38483fc7207dbb1334b29588054882979d2993db
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 27.6MB
        • SHA256 e410b841096415f979a428c1e20d22d4855cf898c424700879ee2b12ba061a81
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 27.6MB
        • SHA256 6d468233e6453132937333291928f6ef4c59d9e501c6a06ce6a3d1c124f3dadb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 27.7MB
        • SHA256 3dce9b577ea72347d1f80e0b1d122278bb3fdfa173beaa4f1f3f66d46bfc4ed4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jar.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 27.6MB
        • SHA256 c0510298a440ad77c67f842be5f534b1d4c4946695f604500f051aa5c3c35e3c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jarsigner.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        • Size 13.8MB
        • SHA256 d0c93e72ba3bf857aa354e19d232abb8b98d9abfa00dd5b53bceec596a937721
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
        • Size 27.9MB
        • SHA256 787eb7a8ceca487a1cc70de79cdcc3a29476ba6428ebb0266321cd0e8b898d98
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javac.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
        • Size 27.6MB
        • SHA256 b6876f39efa8905d2a0b8ac773a48e55d6b0f1c3f9207d626f4924e3e34781f3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javadoc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
        • Size 27.6MB
        • SHA256 a6d18ca7b214d6378803387a73af736f1f3fb01f6e9734eb29ede48e55bded00
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javah.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
        • Size 27.6MB
        • SHA256 f5c6b50061a632c245b55ad1bfab50f0f902b6df4a74221e55b894077f53708b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
        • Size 27.6MB
        • SHA256 c08cd93f689938330712ddbcc4692aa1b8996c3a97025e64e5aab0648d8ed0c7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javapackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
        • Size 27.8MB
        • SHA256 1413fe174bd58bb91bc43aecd5e1b39fadde92db33c5be561a2b253f1572a420
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaw.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
        • Size 27.9MB
        • SHA256 52a4ac33c02fbbcb4458c1fa3d562d336d20ce72b5f99855fba641d50132a1cb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
        • Size 28.1MB
        • SHA256 f72037b20b3c349ad919ee74c878765833df5e864f09b230fa918ceaca69443f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jcmd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
        • Size 27.6MB
        • SHA256 0c45992e2f8e360482ba81bdad95467829e6ecc9a9bb58b3b6f637d28c6eaaf7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jconsole.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
        • Size 64KB
        • SHA256 79a0b1f3b0958e830806c9254c2ba2af079ac99713004febcc3610200c9f504e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdb.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
        • Size 27.6MB
        • SHA256 e7129dcb6db081bce3108288de8068fcc11cc453d2caf2d46d154290001b9cc6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdeps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
        • Size 27.6MB
        • SHA256 15ea71c902ca2aaa9567dab4f324db02f0a182d2ea4ef3fba081cebb93bf07a8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jhat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
        • Size 27.6MB
        • SHA256 8fa9b4243cd9c5232f973197c22c2ebf3d7a5bdf74ebcb1e23d7243fea5dda8d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jinfo.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
        • Size 27.6MB
        • SHA256 692ddcd5445150491afd015961821c05790c0e778939aa8d932632c9f7eccadf
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jjs.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
        • Size 27.6MB
        • SHA256 ef6956b123f293f7448b0c7b8de9af63cfbc609cb4fc2cc06f63a0ca1094fe23
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jmap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
        • Size 27.6MB
        • SHA256 d042e34d8a243205a4ddffec2ee1126b85ce999712f905d247b65fc16d4d7615
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
        • Size 27.6MB
        • SHA256 d757608b17c7ddcd40386a2dd7f35d33f7c96de76a11e179886786d45203b7ed
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jrunscript.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
        • Size 27.6MB
        • SHA256 7ea5afb52742daff489a00f30fe85298ba4d6404343fc1f114eb75080e95d1b5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jsadebugd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
        • Size 27.6MB
        • SHA256 c592fa2c0e15b57fd3f784e22337066b13c9744f8249d7aa33270f80b2faf482
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstack.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
        • Size 27.6MB
        • SHA256 deb85dbe4642e5bd212d0bb2cdae3d1d035c8074550d3a76bb3a73b0e333c9d4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
        • Size 27.6MB
        • SHA256 1c0e8874b7d8a6496d74d04590b1b4ad7a03a216b3b70d2eab206f94d675d980
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstatd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
        • Size 27.6MB
        • SHA256 f2a0f5659e2a260e95abad9bdba433239e8c5f24711bb74c0d0f6e2a61055861
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        klist.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
        • Size 27.6MB
        • SHA256 8da4770ee0b533514106b7c254a5c0c1b5f7abf31b46ecfec27ec6c373ba3649
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ktab.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
        • Size 27.6MB
        • SHA256 4b99d2132255db7771619ff8df4475f240decd608ab4024a82796973afc6e5ee
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        native2ascii.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
        • Size 27.6MB
        • SHA256 1e89cf5de54089589cba992ca23cea9fc144ccc88652610fb3946bc451c6a300
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        orbd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
        • Size 27.6MB
        • SHA256 ed2f0ddab91de48ecb7cf979187d67e276da2e061255eb76d277309589983b6a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
        • Size 27.6MB
        • SHA256 192e2dd7be9c6c0e74474a1f7d6ca249138d792c8e01774f94356102e64ec71d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        policytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
        • Size 27.6MB
        • SHA256 ececb4a63c0b2d4a04d7532373e2c7b48d1df2696bf0c933cc9d7c595a1f0b2b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmic.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
        • Size 27.6MB
        • SHA256 641280bfc20880b018af563387ed3f6c13ab8b969758053976199b2ea8465625
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmid.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
        • Size 27.6MB
        • SHA256 e559881c5da7f18c1a40b95067b14d6858a94a14c11aab95a938afeac7be5840
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmiregistry.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
        • Size 27.6MB
        • SHA256 b2d04943948ee1f40be328271a14872f19568e77fa05df3eb460fe1965d29efc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dotnet.exe
        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 27.8MB
        • SHA256 0fc17e70f76276953503dfba76634065a0c7757769ec00316ab3ce99c4405e63
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 27.7MB
        • SHA256 196ab77b4492e0751c94338d4614cd161efc317d475623f162d5af5125fb47d8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 27.7MB
        • SHA256 824e3843e861396f149cf1c7eb8356dc21916772dd490f27a096be290991f088
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download