Overview

overview

8

Static

static

3

2026-07-06...ar.exe

windows10-2004-x64

8

2026-07-06...ar.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    149s
  • max time network
    149s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260513-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    07/07/2026, 03:05

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-07-06_7073f4e44cabcb1e22bd331117677380_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_stealc_vidar.exe
  • Size 14.7MB
  • Sample260707-dljvmsgw71
  • SHA256 5635d1e5e2747832cdfd549ff3e0cd54f36ac359aa69c1f810970cae289fe453
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
defense_evasiondiscoverypersistenceransomware

Malware Config

Signatures

  • Drops file in Drivers directory 3 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Sets desktop wallpaper using registry 2 TTPs 2 IoCs
    ransomware
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies Control Panel 4 IoCs
    defense_evasion
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-07-06_7073f4e44cabcb1e22bd331117677380_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_stealc_vidar.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-07-06_7073f4e44cabcb1e22bd331117677380_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_stealc_vidar.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:3156
  • C:\Users\Admin\AppData\Local\Temp\2026-07-06_7073f4e44cabcb1e22bd331117677380_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_stealc_vidar.exe
    C:\Users\Admin\AppData\Local\Temp/2026-07-06_7073f4e44cabcb1e22bd331117677380_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_stealc_vidar.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:4344

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        7z.exe
        • Path C:\Program Files\7-Zip\7z.exe
        • Size 15.2MB
        • SHA256 0f329e5c2467753133aba5c925ad73c2d249955bfda9a865e75ac0d148327d8d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        7zFM.exe
        • Path C:\Program Files\7-Zip\7zFM.exe
        • Size 15.6MB
        • SHA256 29f710656bb53e2774514c49ce4cbfcaf3981b769062004336a24e20e653f6a9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        AppVShNotify.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
        • Size 14.9MB
        • SHA256 0b534db5bc56e04c4636ba24c76a7521097984d72d7649dc55bd618b81d1b27e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VSTOInstaller.exe
        • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
        • Size 14.8MB
        • SHA256 9fa185a408bd7c35e1e2a89cd370d9a9a499f7711353a0e1fd33149ec7fa78ff
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notification_helper.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 16.3MB
        • SHA256 5ed8ced0d9de4590c1d34120aab88db22d15407864b5b4f431339477f3586b65
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        os_update_handler.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 16.5MB
        • SHA256 84e013a7c955c9994c2330d6f6aca4e6c09c057226bb1b8e75915164008bb88e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 17.7MB
        • SHA256 fdcd11577fbb07fe2121dd6bb02a77a5c60108f6d4d5941091072933c0cc1e95
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 29.3MB
        • SHA256 e5eb621a9d4c6f7e2d0bcde75db954e64094c2b7fc84bc7a9991486307cf0e2e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 29.3MB
        • SHA256 af0382d64248c4dbb0f85e4f61a712a7c9016612b968c8610908af0b1e88ad10
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 29.3MB
        • SHA256 d414d05d840a648b1586166a6b53780719b0627e5cce0d6ded20795ce7b3b0c6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 29.4MB
        • SHA256 92c7232a63436a1ca72325dc68c18deda79710cceb1e05dccc70959e86ba4852
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jarsigner.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        • Size 29.3MB
        • SHA256 9b6be1d9209214b7f4c1f8333fb3859cb6129c31e9bf1291030088585dd4dd63
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 14.7MB
        • SHA256 674d3e67e5eacc7aff26c2b5d9bf0f6551e2cdfa503736bda00dcc1789ae3bef
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
        • Size 29.6MB
        • SHA256 d8df62d6dfcf7e81bc40ff4077f0d0623b89269726a4dd079cd59166e348b232
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javac.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
        • Size 29.3MB
        • SHA256 b97671f547aa7929603dd511e91af9eef0a9142aeef6982487aa1159b457f1e7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javafxpackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
        • Size 29.5MB
        • SHA256 c1f3133e5b3f006ec69e135ea7465f9f87000c9fadac3ee6cab02fd0b58bd821
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javah.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
        • Size 29.3MB
        • SHA256 69fa095552c2fdf65ab787174fe0c7e2423edadaa335cf2d31d2ad8b6a9afc38
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
        • Size 29.3MB
        • SHA256 13285f733b901469b9960fd87d4d6b511270916fd2c15ea5a4c6e5d64d3f3ecc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javapackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
        • Size 29.5MB
        • SHA256 5a425f3becfa2486f2ceb2565332444dd602b03f6b08886810681de9b4267860
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
        • Size 29.8MB
        • SHA256 8170f74fa32db04dfb18b3befa7a82846fd753365d53cd03ea8c4a554ec48a1a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdb.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
        • Size 29.3MB
        • SHA256 814a15054ce8e445fa941d4e530e79d9ede7443f29601f850656cad57b30acef
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdeps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
        • Size 29.3MB
        • SHA256 0f231f00ed945a14f79d5de67161cdaccd06a124430ad6e58820dd135ca5d289
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jhat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
        • Size 29.3MB
        • SHA256 593813e0b1d3a7e6b4c25a642a27f6c2d7cec637462d14d8893c6f1bcda8765c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jjs.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
        • Size 29.3MB
        • SHA256 6297499e26d02c21dacf47346f722fdfd2c9f1d603ca33e0956c8f69306d1a4d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jmap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
        • Size 29.3MB
        • SHA256 cd8dd4a21b46fff786503c7a401bb0b5224f7a0dc586eda6beda4cc7c0f9fff1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
        • Size 29.3MB
        • SHA256 c8996b25828aaf80cd4dc15f89e4464a5e6733fcbb1cba692fab1fcbdc651c1b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jrunscript.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
        • Size 29.3MB
        • SHA256 0c6913e377388d44180a7142d3b5fed2f7b17dad82b07c6c961b5ddf8b320951
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jsadebugd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
        • Size 29.3MB
        • SHA256 59ced768e170435b658f351fc761783bcf5b5e4f9a027e55763a154f1a9ded68
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstack.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
        • Size 29.3MB
        • SHA256 1d12b035934f904c95b69815c1b1f4727a551bdc67a6627f98a5409acc087db4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
        • Size 29.3MB
        • SHA256 431171b7f3e1de5126af4a9ef697b8c9e24c4aee6ff01dc365278f2cae95a7df
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        keytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
        • Size 29.3MB
        • SHA256 d7a6c78dbd38dc8b66f6818606649f593715a940140aff06297415c82c6222c1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        kinit.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
        • Size 29.3MB
        • SHA256 23ec034867c6ef758e88c50fd602089170d176a947606a11d25cdebb3f95c365
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        klist.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
        • Size 29.3MB
        • SHA256 3d34a700250689290480c41c9fd305670f2c37dafbad888ce76d50fe35a677b9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ktab.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
        • Size 29.3MB
        • SHA256 c0d0d91ebe66bf52760509405904e07da0340639b630f77710dc9385219e7cac
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        native2ascii.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
        • Size 29.3MB
        • SHA256 9d9abecdc59ff582475d406afbab0c78a9738012197df64ff23700c6d957d2dd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        orbd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
        • Size 29.3MB
        • SHA256 1e917c7babd12cd7b0fb49dd9a79b320104f658a64629cca877f56c91eb81c30
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
        • Size 29.3MB
        • SHA256 7e26ada90b3a7ebc2c183415932673c37b15822bb8b94149990e5514f71ec45b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        policytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
        • Size 29.3MB
        • SHA256 6928037b257d0c14e7a172bbdb371348bf82d96199b3144e149f08de9494b5b3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmic.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
        • Size 29.3MB
        • SHA256 1d5f3cc26836922e96d206c8cc7c2e3d0470fb449fa021112c89acab1e28adaa
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmid.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
        • Size 29.3MB
        • SHA256 42df840f2325ea9e0dcb8e229f3b9a32cb01c09f2bf4b176435a9df51950d55d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmiregistry.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
        • Size 29.3MB
        • SHA256 a9df4eda39d637c57d06a21cb5e651c365320ecd99469f5f023883f21023381e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        serialver.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
        • Size 29.3MB
        • SHA256 9a35dacf813a0b61fddbc154df1669ba9405a38499be938e31abfff55d268337
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        servertool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
        • Size 29.3MB
        • SHA256 b1ac5a8ff5dd5a76972b100a81a4bb8b7b58262dd3a2e516915f45cf703d2d72
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        tnameserv.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
        • Size 29.3MB
        • SHA256 c5c435aca0094f37e10b6aed6694d162ed1007b37c839cb4c41f35bdf496524f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        unpack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\unpack200.exe
        • Size 29.5MB
        • SHA256 e5ec460d94b2f1ee1e570a8989d12850076c79f92a4b61b581bd3c1b33fb6469
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        wsgen.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
        • Size 29.3MB
        • SHA256 27624a92417fea964d3fc1092867a314b9eff7022a6a0b41b7eb4f92eba7b8a1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        wsimport.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
        • Size 29.3MB
        • SHA256 d040590fe904f09814a82ae80a66640b102cc9a1612429a1189db13e5a1c02a9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        xjc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
        • Size 29.3MB
        • SHA256 d798cb72d22caca65cfda9215dcf3b87a5ccaa333731f3d8cdaedb0d460adaf6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe
        • Size 29.4MB
        • SHA256 e3719f524cc057e4dda92f7f68a7b7f7f003b68a5e05ffdad24d8aa44f03006f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe
        • Size 29.3MB
        • SHA256 8ed50620c8a3e99d71c530a6b592fa1ab9aa5737a2da79d7fa2c80ff22629021
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\java.exe
        • Size 29.6MB
        • SHA256 9c7bdac195d97a0dac0ff6215a8842dbff103838c360ec3960a530068bf1f536
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javacpl.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe
        • Size 29.4MB
        • SHA256 cbec4eeff83abd3a42ea67bb28f5d63a51e6d0a8c5ac0a32a864aebf64d8de17
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dotnet.exe
        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 14.8MB
        • SHA256 306625fd4748170eddefe53ea75d0f3c434448917a4c7a35decd37fb5c2f6c42
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 14.7MB
        • SHA256 e71ea7d80647cd8e637dbbd357897a48698e4b820872d6b807d2b29770e79d79
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        spo0lve.exe
        • Path C:\windows\SysWOW64\drivers\spo0lve.exe
        • Size 14.7MB
        • SHA256 5635d1e5e2747832cdfd549ff3e0cd54f36ac359aa69c1f810970cae289fe453
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/3156-0-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download

        memory/3156-4-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download

        memory/4344-5-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download