Overview

overview

8

Static

static

3

2026-07-08...ar.exe

windows10-2004-x64

8

2026-07-08...ar.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    85s
  • max time network
    155s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260706-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260706-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    08/07/2026, 15:13

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-07-08_351fa3f2711adecbeb101650e52aca52_cobalt-strike_elex_emotet_glassworm_icedid_njrat_remcos_stealc_vidar.exe
  • Size 44.5MB
  • Sample260708-sl87vsg18y
  • SHA256 b6d6728777bdcbcf48f4746338d0da6680a0320a0065fc6ec4aeb2eac0ea9122
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
defense_evasiondiscoverypersistenceransomware

Malware Config

Signatures

  • Drops file in Drivers directory 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Sets desktop wallpaper using registry 2 TTPs 1 IoCs
    ransomware
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies Control Panel 2 IoCs
    defense_evasion
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-07-08_351fa3f2711adecbeb101650e52aca52_cobalt-strike_elex_emotet_glassworm_icedid_njrat_remcos_stealc_vidar.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-07-08_351fa3f2711adecbeb101650e52aca52_cobalt-strike_elex_emotet_glassworm_icedid_njrat_remcos_stealc_vidar.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:3204
  • C:\Users\Admin\AppData\Local\Temp\2026-07-08_351fa3f2711adecbeb101650e52aca52_cobalt-strike_elex_emotet_glassworm_icedid_njrat_remcos_stealc_vidar.exe
    C:\Users\Admin\AppData\Local\Temp/2026-07-08_351fa3f2711adecbeb101650e52aca52_cobalt-strike_elex_emotet_glassworm_icedid_njrat_remcos_stealc_vidar.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:5004

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        AppVShNotify.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
        • Size 44.8MB
        • SHA256 6b2930310a14de56e0b280ffab912c2457e2b62ffccd635a94417244504dc3e5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        InspectorOfficeGadget.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
        • Size 89.1MB
        • SHA256 d3ccde1f3f60c3807e7f63e08fc6188637bcd1e3e417ced7414d1f1c78e604a7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        IntegratedOffice.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
        • Size 93.2MB
        • SHA256 bb034d3fdb307ca21091e5764876c1909c81f6a0b04dcd3ff8316c46af28a2ea
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MavInject32.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
        • Size 89.4MB
        • SHA256 c6a1ddfa13f855d093d0ae7deb6226deef803ae6e55467cab3b84e016a157e0c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appvcleaner.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
        • Size 46.7MB
        • SHA256 5339f4db2b42113b6b44270cd679377edc1d5b3f0304ed5444648abc097da6cb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VSTOInstaller.exe
        • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
        • Size 85.8MB
        • SHA256 8ac538616c7aba8c3617e5eace66c0291214b6c8565d25ed5f550c0e12212791
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_pwa_launcher.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 79.0MB
        • SHA256 7d286f79aa3ddf019f5238fa4b078bb33e405b926c38ab2dbb46e20af3a7efb8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevated_tracing_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 74.2MB
        • SHA256 26712a5e27c21fbb7733fd9ce0a58f139ac2eb3c27639eeaed1d3d6469923a65
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 76.0MB
        • SHA256 5edca711c2dcbb980d23078db7b6ce97b311b9741a6f557dbb052a596536d848
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notification_helper.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 72.2MB
        • SHA256 13ca6655401875b3e8a2e3eaf11598a5d3074b5880318a965bcdc9cb8e2fae77
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        os_update_handler.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 66.8MB
        • SHA256 fac8af99627ea90487a184d317efac3e52efe5b02081793680d5e0759e922aea
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 71.2MB
        • SHA256 f72461c3c425b165446653b1daec0d3c1f6a59ec3b0e00c97c929d5bbc5b2ba3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_proxy.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 68.0MB
        • SHA256 304c78ed2443ff27b66668b9a9e2f2f354be28b2f1dddffa2d76a9f361973eb0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 62.8MB
        • SHA256 ec893ec06302acb44249a0986ca1eb9c96892100c222758ceccb53b78f6bbdbc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 60.4MB
        • SHA256 9f38135783353a2b2074d5626052c415247941195cec0648832b9b75c23dde28
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 53.1MB
        • SHA256 7cf4dee99fdeec3966e5bd1de3950d6a4094a676ec4529d1807816da13d72ba1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 51.4MB
        • SHA256 088fdd41107f5ecfd27c664b489fdd7e6f41fab30b8bc965d4b1c547442dfd68
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jar.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 51.1MB
        • SHA256 e01800be807d46ce86e62136a56deb0a9d9fce8991757eda23587cdde2fa021a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jarsigner.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        • Size 46.6MB
        • SHA256 60a89b718e518af3b705b1f4a6af99addd17bcfddbc8e481a6e6dadf12e482c9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 45.3MB
        • SHA256 0b809a77d92a015a57d74c5e8c6b08058f1effb523b0f8175c277485917ab823
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
        • Size 44.2MB
        • SHA256 5cacc30e96fc3bc0132164232f62f06f0bd1f9e4627f4e295826d1976842a521
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javac.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
        • Size 43.9MB
        • SHA256 8f9cf8e8262445508fa756597dbf4772c08f5aa28bb17e451530f5a902adb6fd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javadoc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
        • Size 44.4MB
        • SHA256 baac89cabe09409c71e6f5acf2004242da8567c14ce963c429050b61f0985551
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javafxpackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
        • Size 43.1MB
        • SHA256 ababbf30a6382399b5ea4ed95e614b8a5ffad41f8db86fc2057c0288198f8ad9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javah.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
        • Size 41.8MB
        • SHA256 e8697b3a9537acbe93632ed2c0898badb852343f79f52d275514dc24f25a1df5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
        • Size 41.6MB
        • SHA256 7b87000c46bf6c2bad81d80356e02e1ec9fc47cb8d97a13184b0e70de4625986
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javapackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
        • Size 37.5MB
        • SHA256 467cd7f2dbb8bf52478009da26bce45d5bdeddcb4c79f93fd319fd7d906c4a7d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaw.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
        • Size 37.6MB
        • SHA256 076f8ad9d1b4ee078f577f8a16a76aa0bb7b895c11791889eac204be2123055f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
        • Size 37.3MB
        • SHA256 ceedee0c0d4ac42e9a41284a5c99cb1b2ae15f456ebbf49edc8e861dc4d308d9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jcmd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
        • Size 35.5MB
        • SHA256 2793c6cf1e84f0a588fd4b90781852d7ee4ba39b83a78054081eed3e51b8bd2b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jconsole.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
        • Size 34.8MB
        • SHA256 b5cd6c5c2f1b693200ead30eac42655053b857a1046b56fd9a9da0c3c044fe5f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdb.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
        • Size 34.2MB
        • SHA256 faa832c54734eeb721b5fe5d8e90a2d04431c842af62e0c9ff8e73934fbf6b82
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdeps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
        • Size 28.6MB
        • SHA256 818fec34492ad09a1bfa59bb536a11b77cc1f2ce687fba9e722fb1cbcde5566d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jhat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
        • Size 32.0MB
        • SHA256 82b5bc8cf4c5e17e33d9463ce6ab2df6eacd95f1eb48b41a66288c43e82eec49
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jinfo.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
        • Size 32.9MB
        • SHA256 e52b974ed23f1c12166f4d18679d0845c5893b2c84d15a6686b6b2efc04982c5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jjs.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
        • Size 32.5MB
        • SHA256 3336bd0b094be54c7ca49bee94706719839e85d5a3ff5670656ca75e819574f3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jmap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
        • Size 31.1MB
        • SHA256 09c534abaeb78be29e5f0cda67bb004ddeb3fc9249c3c9299e206107806bed36
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
        • Size 30.1MB
        • SHA256 d8219482ee434104d3d48f7289a0d0ca28b42c8fcc41987dc5cce8777acceea8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jrunscript.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
        • Size 28.2MB
        • SHA256 15a5fc27837b03eee16c5b2b36f84de6f58bd535422a9940f37476c1046602f5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jsadebugd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
        • Size 27.2MB
        • SHA256 3068171f6c04e15c7a98e8e5f5442939a94ef35c81dfd2050164e602666703fc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstack.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
        • Size 26.8MB
        • SHA256 405d8300eeedb4ac0c5826415a3a73e03599bb8399f5fff49c48a59ae79ba0eb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
        • Size 26.7MB
        • SHA256 d7bac1365aa50bd2274e243ad0435b139cc351bbfae0be98cbf8b7b33ea1bbd5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstatd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
        • Size 26.1MB
        • SHA256 0e3cd918f35be43e1e73a14ee8262d9c69c43e22d6a5f9a1c5e0737eb99a3878
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        keytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
        • Size 25.6MB
        • SHA256 de0be17c3ecae4b09598e19a2329bc8dfcb571d0bdb4f22ae5d72cbe1a7c2369
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        kinit.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
        • Size 24.2MB
        • SHA256 dd8ff8b39c72d2d2a4e13d080fdfe8f70bff5ad05ad76e9f88bfbfb76f0f07bf
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        klist.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
        • Size 24.9MB
        • SHA256 48d59f87371802de8737ed83b0d1f9a3184d44aa6968ed3d7c9581033372278a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ktab.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
        • Size 3.8MB
        • SHA256 a8089a5fbb6e8894d5a6279ef6ea36c328f3bb8331e1b87df75b4e8e4887b541
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        native2ascii.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
        • Size 3.7MB
        • SHA256 c28b6a1ae2e5920835957edd039f9e285cb18f6d23f5e737b8314cf27ddae8a6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        orbd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
        • Size 2.4MB
        • SHA256 37b3d0d3dbbf1606bb4a03e4c0b0fdb3738993c9d2ac5a0afaf516724ba280db
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
        • Size 2.1MB
        • SHA256 58dce4d107267dbca83d1b83f417ec8a36a20119819bca9f6940baeb2d269846
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        policytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
        • Size 1.9MB
        • SHA256 c447eb05baa21c9d488f3f086561c5c0a97f804bcf084b426156ce78e0687072
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmid.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
        • Size 1.8MB
        • SHA256 19b3dee2fb44eccdcc1d379448eaebe204e48c427f57b8ef7241993b7df71249
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        schemagen.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
        • Size 1.5MB
        • SHA256 8a3c368b47fb046e7fe20c1e6380fec7750fa5b34b11341878b391396d83b555
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        serialver.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
        • Size 768KB
        • SHA256 c6e2dd88fb72337d1d62c38eef8541d15b17897962586f78405b1eecaf7a243e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        servertool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
        • Size 64KB
        • SHA256 561e710c0f12a9ecf3c544ad6eaf227983f3f3f2dcce0bb2f803afccc641ad14
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dotnet.exe
        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 80.2MB
        • SHA256 4368e5744c5b07ea6ce0321cd798544887acbde1eb387081c6875f7bd889e43c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 79.9MB
        • SHA256 24ceea77d36f2143e362e7773980e7789122b82297d014741c054294f92f6714
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 81.8MB
        • SHA256 971790b33673e0f248350943c555161a25e9e4a8ef85159f748c676128c8318f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 81.1MB
        • SHA256 b49fcad906a54d0124136a54de071e00854cabb9b541c0e70ebaff0c17823b85
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download