Overview

overview

8

Static

static

3

2026-07-08...ar.exe

windows10-2004-x64

8

2026-07-08...ar.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    150s
  • max time network
    128s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260706-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260706-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    08/07/2026, 04:38

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-07-08_546184be40b33a8d6cd7866354e2c3cb_cobalt-strike_elex_emotet_glassworm_icedid_njrat_remcos_vidar.exe
  • Size 6.5MB
  • Sample260708-e9eq9sbw9p
  • SHA256 c64f50fb635184c5ea2b6431cd50b70eec931bdfa4fb3f57dee9b8fa93db6650
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
defense_evasiondiscoverypersistenceransomware

Malware Config

Signatures

  • Drops file in Drivers directory 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Sets desktop wallpaper using registry 2 TTPs 2 IoCs
    ransomware
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies Control Panel 4 IoCs
    defense_evasion
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-07-08_546184be40b33a8d6cd7866354e2c3cb_cobalt-strike_elex_emotet_glassworm_icedid_njrat_remcos_vidar.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-07-08_546184be40b33a8d6cd7866354e2c3cb_cobalt-strike_elex_emotet_glassworm_icedid_njrat_remcos_vidar.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:2452
  • C:\Users\Admin\AppData\Local\Temp\2026-07-08_546184be40b33a8d6cd7866354e2c3cb_cobalt-strike_elex_emotet_glassworm_icedid_njrat_remcos_vidar.exe
    C:\Users\Admin\AppData\Local\Temp/2026-07-08_546184be40b33a8d6cd7866354e2c3cb_cobalt-strike_elex_emotet_glassworm_icedid_njrat_remcos_vidar.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:1768

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        7zG.exe
        • Path C:\Program Files\7-Zip\7zG.exe
        • Size 7.2MB
        • SHA256 e6ead18e196546eb60223814de87aa50cdbaefa0a80c1d2d467d331c98b4c20b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Uninstall.exe
        • Path C:\Program Files\7-Zip\Uninstall.exe
        • Size 13.0MB
        • SHA256 cc48c29e3a62e62387ae7e38ad4ff8b3d163c2ea2150ef9660b9bf223cb06b6e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        AppVShNotify.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
        • Size 13.3MB
        • SHA256 b1a15423a3328535cb6d13ead03e724476f23b6c128a5b6719aea3889b5f3b65
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        InspectorOfficeGadget.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
        • Size 13.0MB
        • SHA256 b0fbe4807a87aaaa8e0f7ea8b8066eef0f17986e21116c77a5a6c5bf2b3b6df8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        OfficeC2RClient.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
        • Size 30.0MB
        • SHA256 097b9054be48061c8d75287eed03c56f46dc79e059680db8cba19fc62fe62632
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appvcleaner.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
        • Size 15.1MB
        • SHA256 ba27d794d42da3e1eb9a598b46c7edfa0702a09365622b1d624106b64af0a83b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VSTOInstaller.exe
        • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
        • Size 13.1MB
        • SHA256 213b03df666dceca7afa91ec645a45133dafce65cb4447f07b67e6ce5aec92ee
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        DismountUninstall.htm
        • Path C:\Program Files\DismountUninstall.htm
        • Size 13.3MB
        • SHA256 74c7b820a0e9decd63274405729ffc6ec3665e5a5bd56e6260ca31f9e60d00aa
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        EnterSave.htm
        • Path C:\Program Files\EnterSave.htm
        • Size 13.2MB
        • SHA256 bde69140a007358a8d652f42dbc83f9f6fcde3a5f477ae7fe38f6f81ab449792
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrmstp.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        • Size 19.1MB
        • SHA256 e48aed93dd8f83b2f1ea3be35483b501a7d44ec0e4a0b842be63f4b0d9085765
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_pwa_launcher.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 14.7MB
        • SHA256 137cfee090247668c11cc92f7a7f46dd4175393ddba57dc8c249e8e2b33712a9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevated_tracing_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 16.5MB
        • SHA256 afafaa7f864c4caceffc47899926330fe2d7f047e17b2d71d2a555e6ee38c745
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 15.3MB
        • SHA256 b6ab76561c340c362328450e996313f753791f71baa25f2616a25233d9d1495c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notification_helper.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 8.1MB
        • SHA256 efc05ff040aaaa257b70e42fab9fc566d0938bf24db1a14bd8f377329abfb9bd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        os_update_handler.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 14.9MB
        • SHA256 14acbb3665f905fdf56265d0d4a8569948ebda423efe9a8990e5233e50e60d2d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 16.1MB
        • SHA256 42ccde1131f4bdfb68b8fc587e99399b206f2c42a4237c9b6eaa773d8026aeca
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_proxy.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 14.4MB
        • SHA256 55bc586ae5ac4ca1d373408714af5da2a202a23cb661c84d82c039a498606523
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 13.0MB
        • SHA256 7ed1a686643bf0ce33db67181a5544a94eafd08efa15e937598df51e2f7d4755
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 13.0MB
        • SHA256 e53a5c6846b3a0061c5745cf669bfabab0b38cfada9369af4bcb03be4f29e21a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 13.0MB
        • SHA256 c3d109f53cd5ee357c7a9200585a9a98ed6faa420e10023dd8fc662b79c7b089
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 13.0MB
        • SHA256 be752964dab351abd06c3d47a15db46ae9595568ee138c0f299d203ebdfe060a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jar.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 13.0MB
        • SHA256 1bafea5fed71a09912aa081a4a6aa4d7fe68b9faf8f1cc5770634fca3bb47788
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jarsigner.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        • Size 13.0MB
        • SHA256 ca3b4ebc0bd98a56f5a1243fa2b295a83041a42ff5b230c98d757cbc37820310
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 13.0MB
        • SHA256 545586d96ca65dc3e0105003ff92259f53bf791fbb969714b7d7d9d0b4aa9fed
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
        • Size 13.3MB
        • SHA256 3f5b945feb580e14602db20e60c81e0017186e0abe895581906777e85e388b52
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javac.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
        • Size 13.0MB
        • SHA256 96b0ced17e735622fbf9c1156657df6907a2b5236138f1bc74af7754bbd098d2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javadoc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
        • Size 13.0MB
        • SHA256 8688395c985cfb51d093515f91df94bb7d87335af1bd2305f74d06f7c471f451
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javafxpackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
        • Size 13.2MB
        • SHA256 f6200052c93456cc624f75160decf03a24b9d7a0c44e39dd898edccb1134fcae
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javah.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
        • Size 13.0MB
        • SHA256 3d37b15a6198df39f62264bf556f3f3afd7aa43ad124c7c0d219d24263bf4e87
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javapackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
        • Size 13.2MB
        • SHA256 81d4937939048028499c935284050c69401d921bed909b7eb3c6fec9a3848d88
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaw.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
        • Size 13.3MB
        • SHA256 536becc2f50ac43ec9e85719b27980000d2f08a0b27e867e8880d76db830790c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
        • Size 13.5MB
        • SHA256 65950a4a6ac749da668aec16a7ae200bc37994453ec7a065b526c75ad501b370
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jcmd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
        • Size 13.0MB
        • SHA256 86cf9bf7e84b0b5b4a2da15d77797d90e9c2d28eb8b159f008069ea191f1215d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jconsole.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
        • Size 13.0MB
        • SHA256 a1541e8f0cf51063cbfdc6e488ddb400cc1a4d3766a07e55afbbbaaa88303b61
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdb.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
        • Size 13.0MB
        • SHA256 4d22606615f3a814404dcffa0868b719a93be7de106a94d4013633bad3d71b1d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdeps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
        • Size 13.0MB
        • SHA256 84746ef8715705615096a3741c3dab5f0606e3e612f48c12b99818960e0ec311
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jhat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
        • Size 13.0MB
        • SHA256 b745d41dd08a140634bc3277d1a3ec0ab18214b9b70dcebfba244566b4965298
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jinfo.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
        • Size 13.0MB
        • SHA256 f80b7766630c43a48a71878023b3d11e3815d812465a4f18e29c9d977aa145fa
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jjs.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
        • Size 13.0MB
        • SHA256 560ac38a9d4cb29e15de0eb69ff663e054365b56c83298cee0b59ff8642bd0e0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jmap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
        • Size 13.0MB
        • SHA256 0eadfecd189d6d7248e676863f45387cb1ff43ef64700f794b29b83bd2897e36
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
        • Size 13.0MB
        • SHA256 621eb2ac09e68f16b84502ad0aeba1a53c8f16502f427cfd72f30da3f3ec22c2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jrunscript.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
        • Size 13.0MB
        • SHA256 8a318452e502d67110803389d13d5209f5d557bcdcca61831997da8b5fb473b3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jsadebugd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
        • Size 13.0MB
        • SHA256 0e2f0c3f81f52fd417d445b3e28e7c4308485bfdd7b784b36252fc9be1c80c2c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstack.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
        • Size 13.0MB
        • SHA256 3f971908ef0a9ce2e6921103297adfd0ed2e08ec9b2f4bcc74ef8f978667ea79
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
        • Size 13.0MB
        • SHA256 ebed5114e7fabcb852669c387ef7874577620795eb129c1933ad492238a1a500
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        keytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
        • Size 13.0MB
        • SHA256 547ccd64eb5a3c4795b218211279a8207bc2b87ec3a28ac39d24346d6a19c100
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        kinit.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
        • Size 13.0MB
        • SHA256 9fe2470403eb7946eb16fa79e013a6a485ad893ea6b993bbe8d131a511b02a49
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        klist.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
        • Size 13.0MB
        • SHA256 fe890f9cc9f18da0f9e0e69f1a7efcdf41c076d2204b2b3c7b5b348c681475e6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ktab.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
        • Size 13.0MB
        • SHA256 1bb85868378e69cc8f880ba9c86e1b12cecc48d30d888b813599404b1441d319
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        native2ascii.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
        • Size 13.0MB
        • SHA256 a66ded0ef2697baffd4837dc4bf83948cc6092ca9e788ec527ab54774b250ce3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        orbd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
        • Size 13.0MB
        • SHA256 cc6eb26b55280313253362860497808d003d599d2d35f395987b20e0fc2d1791
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
        • Size 13.0MB
        • SHA256 0b0dd04ba3f832fbb36c8fb26e6eb5a14536355dba1bf6f886a300245f792cba
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        policytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
        • Size 13.0MB
        • SHA256 e74281e1407a1d094d54294bd9ee4deed32d7a69fe8f80cfe3423df227f17b4f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmic.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
        • Size 13.0MB
        • SHA256 ceffeb39e60f1a68626a1705593a9cadede0dafcf4d6cfc26c6a59dc3a0d0aa1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmid.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
        • Size 13.0MB
        • SHA256 f7e51963dd58c31eee24151078a0e9e7e55e20c39605f5b71336c873908f40b5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dotnet.exe
        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 13.1MB
        • SHA256 87b6a17c9c90c27f75392cf873ae8417eb509b2ba0f85ca53e6b084ffca2c3f7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 13.1MB
        • SHA256 852cc18e2c931e96db5ae713a2658f19a7a3b4117a38280f6e40be80a2fef3af
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 13.1MB
        • SHA256 8adfe459948b324e4105dab92a02a6cd52ac6c6cb3b312eed0d13e5e5038d824
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 13.1MB
        • SHA256 645dad1bc81b6720e251f9aa7aa32ec30f0023a6ed97b0863f79b278e20e12f3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download