Overview

overview

8

Static

static

3

2026-07-06...ar.exe

windows10-2004-x64

8

2026-07-06...ar.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    148s
  • max time network
    125s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260706-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260706-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    07/07/2026, 04:25

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-07-06_36edd7916102c5638c4ca1d8fb889b53_cobalt-strike_elex_emotet_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe
  • Size 13.1MB
  • Sample260707-e1646ahx6x
  • SHA256 66cddffbd98ab6ef46e4d98b4a71608203bdd16d01e916f2f3d8a1f9b9c61e99
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
defense_evasiondiscoverypersistenceransomware

Malware Config

Signatures

  • Drops file in Drivers directory 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Sets desktop wallpaper using registry 2 TTPs 2 IoCs
    ransomware
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies Control Panel 4 IoCs
    defense_evasion
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-07-06_36edd7916102c5638c4ca1d8fb889b53_cobalt-strike_elex_emotet_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-07-06_36edd7916102c5638c4ca1d8fb889b53_cobalt-strike_elex_emotet_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:2888
  • C:\Users\Admin\AppData\Local\Temp\2026-07-06_36edd7916102c5638c4ca1d8fb889b53_cobalt-strike_elex_emotet_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe
    C:\Users\Admin\AppData\Local\Temp/2026-07-06_36edd7916102c5638c4ca1d8fb889b53_cobalt-strike_elex_emotet_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:4060

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        InspectorOfficeGadget.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
        • Size 26.3MB
        • SHA256 42939901cea6d8c0d76026fd3ea963852b53b157daa0d08344403a1d0ecfca92
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        IntegratedOffice.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
        • Size 30.3MB
        • SHA256 4a86c8246a67263430fef64c13ba25ed33cb1dc5555cecf199384bb44401f26b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MavInject32.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
        • Size 26.6MB
        • SHA256 72e7283b0cd4f4e6852e41026c26199e2edad358590f5bdd7df65968d61b4aa9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        OfficeC2RClient.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
        • Size 49.7MB
        • SHA256 e93f0b80575954df5ada4c31c7b324ab8748747add12742e889b19acc872d249
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appvcleaner.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
        • Size 15.2MB
        • SHA256 f92f4c471f27f9d830f37f88dc57c3ec00de37295efde60f3275a9f063738376
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        setup.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
        • Size 32.3MB
        • SHA256 cf23a4be39acafd1b0ba902a11e9fc982cbed6dafa8506ea1697cbd6dc41ee7c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 28.5MB
        • SHA256 f37b5b77e0d8df65a1f5a36256a4c095a14b76c1bfdc822d69e3353a62cfb732
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notification_helper.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 27.9MB
        • SHA256 9488a577190c62de94de1ab31672eb76a8856e642700b0f5aa32accb33494799
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        os_update_handler.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 28.1MB
        • SHA256 62909c17e96a7c11db76a4c9eba0986c60a9873d3dae0c894c840cfb2d7be777
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_proxy.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 27.7MB
        • SHA256 7df1cb578ae658f56df00c14599922038a3799b11b5b79bf0499bc74f62ee77e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 26.3MB
        • SHA256 b2dfa21ab3becc88b3096bfe896feafc512053f8a8cd40e942cf948eed52a92a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 26.3MB
        • SHA256 eb39fa67184157ca1e477bd7c9e1a4c1601c8494a2b48b85713820dbe1a531e8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 26.3MB
        • SHA256 7a22eabe936430aba7c16b830059fc81956033ce97416e9be6f58ae582993949
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 26.3MB
        • SHA256 2f9770287b4ce33e6376d24694c9be3a1d4a23512747f4e7866036db24fc1964
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jar.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 26.3MB
        • SHA256 79203bd183132c8b5bc760cf8a801ac34cdb36913d91989a1bf3c708aa5b4ad6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 26.3MB
        • SHA256 23196c6331e8c17453b61c24914a83104ed38a902a77ea585a564f5dbc6c7ec1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
        • Size 26.5MB
        • SHA256 662ac9f497a818a83746f7e16e723444db76d60794fa26248cf87076f264318a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javac.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
        • Size 26.3MB
        • SHA256 b325ae3b424118ec3edf4150998a207a3abc259f9ce6f0147bd200bad941f390
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javadoc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
        • Size 26.3MB
        • SHA256 cc5dfd781227a3a56ce8a98e35ab6e6b047b2f25efb9c2c377d2761e2086348c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javafxpackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
        • Size 26.4MB
        • SHA256 c8c05c41a1fd037608ae34f7fca4d3c64b938104d718cba4f70b27146792eee3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javah.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
        • Size 26.3MB
        • SHA256 ed5842e6b8e1f5c5e4aa06ee4de36700f721aca5f1866afb8bdc9eb3ef260dca
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
        • Size 26.3MB
        • SHA256 71d68e4110e18d8cdc6ad49133b1cbd60da2b9dd6a8053e8d2ebec6f7ad3de4e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javapackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
        • Size 26.4MB
        • SHA256 527e3ab6f525cdc7c78049922f7a991992f50f5890ea9f855891b1967bf28050
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaw.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
        • Size 26.5MB
        • SHA256 331da2823e82769a29a348047b0a020aec0d8657aa9d50cc0fec543d94b0a09a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
        • Size 26.7MB
        • SHA256 d923d8c9311526b88bafefa41519e86a997bc8e3591b25fa7f8f804f2c7c779e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jcmd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
        • Size 26.3MB
        • SHA256 994049bb2d1928a5ae8dd9ab267750046ea2ef2266d09c456c208ec6502f8d61
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jconsole.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
        • Size 26.3MB
        • SHA256 ddf9f63ea80216120a51ea3b69196488f41fa62c68733e92fdea5d51e57d070c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdb.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
        • Size 26.3MB
        • SHA256 8285cbbbe4d0ba73dad04e5cf0af6e88ea999807ffe8ecc2eb535bb14ca65295
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdeps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
        • Size 26.3MB
        • SHA256 f3d850ae3d9ac2e70698ce12b41aff91fd82e734ef26b1b920e76f6e8ea2988d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jhat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
        • Size 26.3MB
        • SHA256 3748214773a967b1d251c4e10fe3165ce1b3729cb9baed674be6db959e5df740
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jinfo.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
        • Size 26.3MB
        • SHA256 bdcc6bf5776ab43794c60b8fdfbe9184204d0be947fdfdba2687c9cc4dda5602
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jjs.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
        • Size 26.3MB
        • SHA256 60396dd59f640bd429347ceb4c976ae20c692c8825d9b1d6ff9260a7daa34843
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jmap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
        • Size 26.3MB
        • SHA256 7520740fef7d6b5217ceb1021bf1bf16f4fbd15e267b43d500cc0b0a4fd3e08d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
        • Size 26.3MB
        • SHA256 d8c6c05571742ce1e855157bede26d5b3e6bbf851ec993a9b5b219c39905ed18
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jrunscript.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
        • Size 26.3MB
        • SHA256 7d4b7b6017fa9a9dec62dae8e7416d73b5c5b56214cb12ea2f9968658b3bbec6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jsadebugd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
        • Size 26.3MB
        • SHA256 73f00d32525deaa496c00c15cc9ec38129a38e6fda947106c3cfdfe54c31ff84
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstack.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
        • Size 26.3MB
        • SHA256 ce1ee5a87debb8f492a12747c7bd8827d89183c8c7b463d2e240402742c12be0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
        • Size 26.3MB
        • SHA256 973df51bca0e76352b0d11e31732c9479adc15ee6193bec6a0662bf51cc40145
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstatd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
        • Size 26.3MB
        • SHA256 9e19c881b1a2a13af9583593b9f87dbb766ca97e5353a779a0ab1643b7c1d2a8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        keytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
        • Size 26.3MB
        • SHA256 f833679ff08dc779b38659495c1833373ff1945b267c7d57774a911f6f92eb36
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        kinit.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
        • Size 26.3MB
        • SHA256 61a68b13a2eb35fd2cd65b5711aab355b9028ea5e742888d8f722c236e045c7e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        klist.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
        • Size 26.3MB
        • SHA256 8db7f72e8e3c902826c5475f041bdd7d805503418ba5ed6e347737e288dd4ebf
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ktab.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
        • Size 26.3MB
        • SHA256 b7dd2014de03c6e7706335162ddaf714e8fe361d05bc5d266d8ec1bb1c1764d3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        native2ascii.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
        • Size 26.3MB
        • SHA256 adb22b1dad0a8de28f52a5f1c37a2ab54ac4100fcaee53e365e7b5e5d2d38b22
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        orbd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
        • Size 26.3MB
        • SHA256 4550a4b98dec81f31461d2d4260eda9c4212470b7c07daa2e3ad343f1ef58072
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
        • Size 26.3MB
        • SHA256 5deb1ccd34b775ea7c1e48ed7260ecabeb444b22326f3156c02c3a7d8026c3bc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        policytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
        • Size 26.3MB
        • SHA256 37f8dec4fee2932f71b86e84ee033a3d2911922c89c9eb945667362aff287cd1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmic.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
        • Size 26.3MB
        • SHA256 dfce83cdadea7d534cc73b5c9b914174c328aa753b69ea1766b77d858ed686b2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmid.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
        • Size 26.3MB
        • SHA256 6724c3f636a198234c582360751a590664df88f148834675d9a394a4cadd750a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmiregistry.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
        • Size 26.3MB
        • SHA256 8212901659c032a71d5a25a7c3c6e557a81b450b0c9c675961c5bd23ba0d2f39
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        schemagen.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
        • Size 26.3MB
        • SHA256 ce1afce180bee99d6e923f97803dd796140e583de33f76873a0c7531829484fb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        serialver.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
        • Size 26.3MB
        • SHA256 0729e12f164d22a68357486ed1f65672cbf666d1751c443e451651cc3abb5824
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        servertool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
        • Size 26.3MB
        • SHA256 1f44668b1e2bf862807a1e27161133ac72837ff116b409a280ac87dbd6463daa
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        tnameserv.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
        • Size 26.3MB
        • SHA256 2b343c7bca9ffb204faa96f19034e43e8036eb736a6f97aa314f50667ca7ec77
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dotnet.exe
        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 26.4MB
        • SHA256 dc8fe9563d5e3bc99d34284cfdb87fd0e99bd9f14c55bbefe018ff51d14f4540
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download