Overview

overview

8

Static

static

3

2026-07-07...ar.exe

windows10-2004-x64

8

2026-07-07...ar.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    149s
  • max time network
    125s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260706-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260706-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    07/07/2026, 20:02

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-07-07_a7f186effa0b4385ab960293489ee9bb_cobalt-strike_elex_emotet_icedid_remcos_vidar.exe
  • Size 11.9MB
  • Sample260707-yr5phsdt7s
  • SHA256 99be5570cf98b951571888bc28c5db4f73b509915a7b8a02656b9537559832c5
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
defense_evasiondiscoverypersistenceransomware

Malware Config

Signatures

  • Drops file in Drivers directory 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Sets desktop wallpaper using registry 2 TTPs 2 IoCs
    ransomware
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies Control Panel 4 IoCs
    defense_evasion
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-07-07_a7f186effa0b4385ab960293489ee9bb_cobalt-strike_elex_emotet_icedid_remcos_vidar.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-07-07_a7f186effa0b4385ab960293489ee9bb_cobalt-strike_elex_emotet_icedid_remcos_vidar.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:3760
  • C:\Users\Admin\AppData\Local\Temp\2026-07-07_a7f186effa0b4385ab960293489ee9bb_cobalt-strike_elex_emotet_icedid_remcos_vidar.exe
    C:\Users\Admin\AppData\Local\Temp/2026-07-07_a7f186effa0b4385ab960293489ee9bb_cobalt-strike_elex_emotet_icedid_remcos_vidar.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:4608

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        AppVShNotify.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
        • Size 24.1MB
        • SHA256 634a5c3456c899f3dd7a09b9e1073187aa795e2f208a038c7086f0e3841a8eb5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        InspectorOfficeGadget.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
        • Size 12.0MB
        • SHA256 377a6f3c767b1d177524814137647ec4e6828a865ce0367e37e376fa9a8516de
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        IntegratedOffice.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
        • Size 16.0MB
        • SHA256 e130753e2cd54e644304c751808d25a0e772525fcfd4f1075d73091d28f675a2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MavInject32.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
        • Size 24.2MB
        • SHA256 31729737d18c0143163ace3fe9e3e4120de8dc84396d0bfee29a85368ecfd513
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        OfficeC2RClient.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
        • Size 47.3MB
        • SHA256 6ac93136c73b1adec984baf8c6e7ffc5766c967134b77ce09d5815a66be3e6ff
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appvcleaner.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
        • Size 14.1MB
        • SHA256 c86a5a874b98bb317a8e2202c75f3aaa387a856c16ae604f3625e8e9d52f35d0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_pwa_launcher.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 25.6MB
        • SHA256 c4a9c1465d6410d05305449dd8713a6f64cc01df506a7df17b2e760c9a7f9687
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevated_tracing_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 27.3MB
        • SHA256 6baf39469a1b788fe1f0544290f5bd33b0f0f1440aa6a4fbc004fa7c35b485c9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 26.1MB
        • SHA256 dc2e5b200ce22e1a996f0e17060f21ff274dfbfbd3e926a718e7f43aa2e3b06f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notification_helper.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 25.5MB
        • SHA256 a83a80ca7c5bbb6a0c70a0b31211c39b17cbc6224e2367226f6694f40b788221
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        os_update_handler.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 25.7MB
        • SHA256 e4d48dd70c3c34080328759a675d7947ae27ce791d9ab3056753dd8b9319fafc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 26.9MB
        • SHA256 28e5046897bac4dfcf36166002718518a39604e3bc36af768ce4b7c306ba9525
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_proxy.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 25.3MB
        • SHA256 6e623d06299233769406924b32af8fdacdc353dc3cdea00166208b96abcb90ea
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 23.9MB
        • SHA256 e987b7dd84b3733bda051642630affe919a249b3d0eb5b49b8494d2ea0ee5870
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 23.9MB
        • SHA256 c477f97e17c99acbecf7c8726c5218764d06b8ea4b4824f990eadd7cdd215820
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jarsigner.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        • Size 23.9MB
        • SHA256 65ddfc7b2f0b2e64c9d8202df6d1ce720e1afd69a2614746a36e32b1ca91f49f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 23.9MB
        • SHA256 b1e87bbb739408212e9e33e51191ff30d6c6d9d4c4e73107f69869a48b0f7a2a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
        • Size 24.1MB
        • SHA256 6eed41145bdb762ed2f7cc6e0035f4f310a83d01eb599cdff22b19b46a8f5ac5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javac.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
        • Size 23.9MB
        • SHA256 59670211f797137a07b371757c1d68e29d4bc4a9518468ba9bf19a4c3bc09170
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javadoc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
        • Size 23.9MB
        • SHA256 d54d7f72917ddc5c9d52be26dfaca6920ad71865dc1d8d0aeb9e8df73cfc860b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javafxpackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
        • Size 24.0MB
        • SHA256 015f597c06e04e631bfd0cd0c32209e238424cb8ab2ed8d206fe9b2a729d4996
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javah.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
        • Size 23.9MB
        • SHA256 ec9dab72f0230c3d552a48e605d95040b8b8366ca7055cdeb405654db045e250
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javapackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
        • Size 24.0MB
        • SHA256 46a99407b1458a58fd31e368702efcac61d633cf31f77b5a4e95aa1f48d3661e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaw.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
        • Size 24.1MB
        • SHA256 f3561ee31cf30e30d7b4f8ae2abc9c03f3d38a6aa90f7efff16f499ec738bb00
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
        • Size 24.3MB
        • SHA256 1c948436137ad618a94f5b8c1852bed914ccf2b9a431b2a19632c3760937520b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jcmd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
        • Size 23.9MB
        • SHA256 ef9f600adbe5d8000eddf8ad0897138f639970d1e41438c7b96be3befdd40818
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdb.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
        • Size 23.9MB
        • SHA256 74a459a73e818526f2b8e6b78cff1c03bdd3b2c8c97a823560f0d39bf149383f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdeps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
        • Size 23.9MB
        • SHA256 9abbacb8f1ed9f2e46693db3b02ec2fe89346e5e1cbf7f0a6875154b04705055
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jhat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
        • Size 23.9MB
        • SHA256 ff81bd89a0db24472e9f7e9eb3077ed0c21c8e161a59576f5fcc273747fd556c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jinfo.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
        • Size 23.9MB
        • SHA256 269f32f72514c6e31163241c5de4903e24259a33017d6cd08ff4896d70085d20
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jjs.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
        • Size 23.9MB
        • SHA256 e8f88eaa559169a17e332753b0d562c417fa54fd2833b8341dfcab2316a54751
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jmap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
        • Size 23.9MB
        • SHA256 924ec28cdc04a502c78501f47141a04af28576c3fd80ad9300c89228c750702b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
        • Size 23.9MB
        • SHA256 0d3adb663cdfc627afc7c08f1c955da4c6ccd48605f4ff9ae116f26fa766665e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jrunscript.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
        • Size 23.9MB
        • SHA256 e62aab0d9053dad4c2eb768c36350ad51faf9eefab4bb794842a25c8287fc119
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jsadebugd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
        • Size 23.9MB
        • SHA256 30dd468575ad2bb20f1614df11e56c101d7123d7b9ab0c713958c84cedca9c95
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstack.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
        • Size 23.9MB
        • SHA256 3669887e7e608c460163bec9d3db1ba95a5394231729605d089d8211af097bb4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
        • Size 23.9MB
        • SHA256 d83cf30a9d989f68715e7ab96c34d52451f986730355746ab80b32c93b7a636b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstatd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
        • Size 23.9MB
        • SHA256 d8bc3fee08c1dbc21daf83250b46704e04c06ea7a876c3fc8a0574b518c63343
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        keytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
        • Size 23.9MB
        • SHA256 3c3f99d0b7735470aa61a89627a75f9dc26fcbe12bfa6ded16b884a7271c9b6b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        kinit.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
        • Size 23.9MB
        • SHA256 ad441545ccc53b1cb246e0165d275ae32788c526af9ef21583548ea971bc98ec
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        klist.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
        • Size 23.9MB
        • SHA256 1720c7d2cf9efdc6322d0a35e740ac050f0a003c65ca77519bfe805b7a240bef
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ktab.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
        • Size 23.9MB
        • SHA256 ed24c0465349e32599e234cbddb8431e7ac6d548f14b45261ed047c5b82d6914
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        native2ascii.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
        • Size 23.9MB
        • SHA256 c7cf9f03785969487421da6e52f15e0162ad754157879e2b3723a84f29a86401
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        orbd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
        • Size 23.9MB
        • SHA256 075c05ca3e8de0cde2bb9be8b1a86829b146ece1bb6a8f63f11a86519ccdb898
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
        • Size 23.9MB
        • SHA256 e41ae933daa0990423c76f8af734fee42715cf694ad367c3107883e81dbb36e8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        policytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
        • Size 23.9MB
        • SHA256 57538f78aa0956bb593cdc0c118bf97a3a1f664402d1c81582a32f3ce814ce7c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmic.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
        • Size 23.9MB
        • SHA256 b6b7e6b8601882a84e577426964a4294b4ad9a422348a6d994e1a3a780f319c6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmid.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
        • Size 23.9MB
        • SHA256 dc6c1f1011a253a70b769ec6bf21c5ae6ed75b39011a997708ec1de994541b1d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmiregistry.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
        • Size 23.9MB
        • SHA256 fb0ea145769bf67b18554f669f10581b3bc27736e4421f1fc6e3f139faadc490
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        schemagen.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
        • Size 23.9MB
        • SHA256 cd0c54d62ef49d9128b2fe71c99b7a927735c5cfb177923d5dee088b09876f0b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        serialver.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
        • Size 23.9MB
        • SHA256 8cec61a0193f271fd28bad959d3474df804844bc82c3e9652d61e0c6fde6fec6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        servertool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
        • Size 23.9MB
        • SHA256 84b03c55c0aa65c3c58f37e9331d8338df6e65007c7ad140b10ad645d43f3e1b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        tnameserv.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
        • Size 23.9MB
        • SHA256 f1e31172a3ab329634de3849a112f2a1fea92ba3dc6b9a3003a174b06f847ca0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 23.9MB
        • SHA256 2c64af13d5fb545299133870fc9287ac29c7e732b49f1de084d3a1c096d3e522
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 23.9MB
        • SHA256 fe1bbe03a2b0c4e092e163f09368a0550e6aa03e71d4aab47e1563fd6193a54b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download