Overview

overview

8

Static

static

3

2026-07-09...ar.exe

windows10-2004-x64

8

2026-07-09...ar.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    149s
  • max time network
    141s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260706-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260706-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    09/07/2026, 12:13

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-07-09_c240ae1ab14a311501896e26b300bfe9_cobalt-strike_elex_emotet_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe
  • Size 8.8MB
  • Sample260709-pdtweshy4p
  • SHA256 91544bd3651d74099a6be0e9dad7dff273ab7fd1a67792d76cffba44872c2919
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
defense_evasiondiscoverypersistenceransomware

Malware Config

Signatures

  • Drops file in Drivers directory 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Sets desktop wallpaper using registry 2 TTPs 2 IoCs
    ransomware
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies Control Panel 4 IoCs
    defense_evasion
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-07-09_c240ae1ab14a311501896e26b300bfe9_cobalt-strike_elex_emotet_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-07-09_c240ae1ab14a311501896e26b300bfe9_cobalt-strike_elex_emotet_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:2032
  • C:\Users\Admin\AppData\Local\Temp\2026-07-09_c240ae1ab14a311501896e26b300bfe9_cobalt-strike_elex_emotet_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe
    C:\Users\Admin\AppData\Local\Temp/2026-07-09_c240ae1ab14a311501896e26b300bfe9_cobalt-strike_elex_emotet_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:3808

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        AppVShNotify.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
        • Size 9.1MB
        • SHA256 39070237ba3924fd265c41028a87b5639ec457337b702b82bf33e8021a4c08c7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        InspectorOfficeGadget.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
        • Size 17.7MB
        • SHA256 81f385efec3c070d05160089be651a1aa3cba7951e6af23e3379a6949272a8c1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        IntegratedOffice.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
        • Size 21.8MB
        • SHA256 a5185fef4daf9ad78b148d188842295938b73cef736f95f7a6197dd1ae43c261
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MavInject32.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
        • Size 18.0MB
        • SHA256 73a04c78ed85934d0b18e19c03a51dc63ae0393a0df309bac080c96cc9cc2eae
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        OfficeC2RClient.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
        • Size 41.2MB
        • SHA256 69cc79b6b2217f110af5e918ca809e366faff1f2f05f3966533c450ffa5b0acc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appvcleaner.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
        • Size 11.0MB
        • SHA256 490ead255254eafa1afc371dda2b84d5d1ac37c562e7b3a86092452ccfceb94a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VSTOInstaller.exe
        • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
        • Size 17.8MB
        • SHA256 d95bc491287b3d5a8d11454361d22c1cbee9f11e9d5efbe8a68d5eab3d20e27a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrmstp.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        • Size 23.7MB
        • SHA256 17c7db507c3ef38a8a09ac6f43728f5a6dc5aaabb73d1eedf49d43eab4297061
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevated_tracing_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 21.1MB
        • SHA256 c2f4f14cf7e29e9716641e94717b47e4fbb5de960044694fc50b59273d4492e0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notification_helper.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 19.3MB
        • SHA256 d39bf703ed2efdd7c828315910f4cef4addd1c8af547c4aa29a0de220e628dbb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        os_update_handler.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 19.5MB
        • SHA256 a2354c08b65945aee439742aa66b600b645bd66e4485e7327cda16976d078348
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 20.8MB
        • SHA256 5d8921916bdcf5cd5621435642f52f8d4c4f1aa77b4e8c4bc1a4970a96cf186a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_proxy.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 19.1MB
        • SHA256 9d3b972b4af00a79ccba01ab3673a98f076482aa3070bebc8f3cf32335fe01b7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 17.7MB
        • SHA256 a34b300b9b21ee589a0653cb97ccd2994d71489677bc144551af62dad553797c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 17.7MB
        • SHA256 6bf7157054b964704748606e6cec6f4e7d21bb953f6e873f31e00b2c421ec93d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 17.7MB
        • SHA256 1095ce33843a6f47ebb6fe9da0061bfbe9744db5eb932a78b5c3b4e1ddbfe030
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 17.7MB
        • SHA256 d64055d521b9352f5fd9a49687d96fda7a1a781bc807200a18cdb7621eb81d85
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jar.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 17.7MB
        • SHA256 3f18d728867c525700622c095e7c8c5dd22a934f09d9f9e94ba594032a556fbf
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jarsigner.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        • Size 17.7MB
        • SHA256 58b038c1cad9bce3263d5d0063553934fc1559ba1aa04a3a9ecdf6825eeab8dd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 17.7MB
        • SHA256 2017d592f81527a4c28ed1d81f52c8d29fc7461268f3be8ce09a27d9daf28912
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
        • Size 18.0MB
        • SHA256 4b103aac112612664d5f019afe6f32f93b3df2b111fbfad54ac46b5a063229f6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javac.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
        • Size 17.7MB
        • SHA256 c643d2e1441e55e916d31c2d1c8667beab3fb6d752000dc805a7655fee360086
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javadoc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
        • Size 17.7MB
        • SHA256 3a0d99818fa2981793d00a7eec56bfb42ca7ea871269eab6bc81b80beac7ab4c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javafxpackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
        • Size 17.8MB
        • SHA256 6f5e1028db584c9077ac15372f19d4d98723df4d73084895428c12de80b44a1f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javah.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
        • Size 17.7MB
        • SHA256 6a6455ec22d31a406620e1214c44e5247535644566bec86f2f1399191b037f45
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
        • Size 17.7MB
        • SHA256 5def5fc7424ef845f7a608c4879b363bd7a32a4d2c3901a79ad6ee53f1abc45c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javapackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
        • Size 17.8MB
        • SHA256 765a521ded2c5649e72f16062a204512f192e5bb90629fba1034563da08fbb36
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaw.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
        • Size 18.0MB
        • SHA256 c4f2f8f0cc5442c07dfab04ce2ccd8e2c385130eca8ad2224b2ba5d8281db993
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
        • Size 18.1MB
        • SHA256 14d1f9bac06df63bcf55f894cdb126165ebbfd4ccd2b882538a1fe0dcdc4002d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jcmd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
        • Size 17.7MB
        • SHA256 154c780b79d25ffc9463fde7b0b3f4f7926b7899fc4d49fe2ddaac79f374fedb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jconsole.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
        • Size 17.7MB
        • SHA256 7fb922fcd331c2762f8f7a09e16bfb7089ca81b02cab9642125c5020a5052bd9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdb.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
        • Size 17.7MB
        • SHA256 a851ed0e9045b3cf6abf631c2c3ec38b2b4965c12e159b6445aad458728678dd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdeps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
        • Size 17.7MB
        • SHA256 905c631723eeb68e8972a7af356bf0b51d04ba8d1cd06e701b3e822e638d1a4c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jhat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
        • Size 17.7MB
        • SHA256 80f0c55a9bc3d0f7768a53b970e4a74d58054515d7a81a669f757280e8650c09
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jinfo.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
        • Size 17.7MB
        • SHA256 a9b5da3bec1fc218def5b649aebe5877e258ec43803d1ec2f21dfe3051bc1eb1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jjs.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
        • Size 17.7MB
        • SHA256 b13e0593a2657c9de39513334dcf3c38d4bf0e5f56c274200121afb77ec9febc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jmap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
        • Size 17.7MB
        • SHA256 51a885d294072f5bf29ce2bb89436b23799a61704d1f26fb733f6d68972fad70
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
        • Size 17.7MB
        • SHA256 2ec02d15798db8ceae1b5ecd5958b16716c4feb28973048be1f81823d02ea745
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jrunscript.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
        • Size 17.7MB
        • SHA256 4b396ba26d7f1ebedc322b405e4d5a033ccf0c8f559ef9940899d5dd3a081807
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jsadebugd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
        • Size 17.7MB
        • SHA256 019b1938f824ade9224751e5da495c2e3c21a500fb44c9bf687d46918b29634f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstack.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
        • Size 17.7MB
        • SHA256 a9d9111450d134320a0365e20c4930e9a50e7e6296460b038a99994a72d1eab9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
        • Size 17.7MB
        • SHA256 1a571b9ddd044d93863c4c3f6086a88b11b2e8e439c689a117b8161e051afe35
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstatd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
        • Size 17.7MB
        • SHA256 bb5a901f65710e1f65c67453593b84fd39a4db1858b6c8bd400275294563c1a1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        keytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
        • Size 17.7MB
        • SHA256 004fcb3d45312ff255aab4d79fe6879d9c3e4e9a7e278a08a273bf40b37f740f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        kinit.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
        • Size 17.7MB
        • SHA256 3cf6917032cbd2c02acd823b8de12746df1eafd00bfc21686a5c158d356c355c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        klist.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
        • Size 17.7MB
        • SHA256 283b6654ce8f495039b32836cb44eb934bba5b7446af3818624bb9fd5d7732fd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ktab.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
        • Size 17.7MB
        • SHA256 0aa48eec8567105a88eee63f9b19b1037664f13525163b3fe5ddcd53173820bd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        native2ascii.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
        • Size 17.7MB
        • SHA256 c2dc78196a8aebcb4e0130711a80d02a14a6eaff713fa66925e9ef4eecca4e10
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        orbd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
        • Size 17.7MB
        • SHA256 7fde0a7929e85f1ca44581fc196c97eab6d2f15be071bb243d4c43d794a93594
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
        • Size 17.7MB
        • SHA256 3b26d30eabfc77f8dda186ad6d4a7d1bed2e63c8fa49f3dd31d4d249a9587363
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        policytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
        • Size 17.7MB
        • SHA256 055f3ac02eacf583220ecf415d73ba620b236c30734a3551a1238b0e56cd651d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmic.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
        • Size 17.7MB
        • SHA256 72b160c43f836e84f0be022080dead345adb548ea195fa880b256e7d105e12a6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmid.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
        • Size 17.7MB
        • SHA256 be51cc3cf7571a83687cf12f786cfd961c981fc67947753c5d07503ee2c7c2f3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmiregistry.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
        • Size 17.7MB
        • SHA256 1acffdd08b79c296cce14514ad084645cf153597715d0ede47cbd022ebf3eb01
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        schemagen.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
        • Size 17.7MB
        • SHA256 514c3a004f0134fc71a9892d6a113b7370d3c077540ae2a92b5ee0564f4a3824
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        serialver.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
        • Size 17.7MB
        • SHA256 dfd85618263a54f8923045ca2539df831906752f4e2aac120369c11dfa0ea153
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        servertool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
        • Size 17.7MB
        • SHA256 393f93907202f789a0d2cd5b58305dfebee8c55c5e5290e5b4e75fd8e0522dd0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        tnameserv.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
        • Size 17.7MB
        • SHA256 5a6cd4b67bbafe38783a9d19d13d57cdc261e1cc655cba8e903687ee464f3e55
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dotnet.exe
        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 17.8MB
        • SHA256 3fca6ddc9a3631946019efb90a073205f26d71eefd9d58e86c8f85a10d335b37
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 17.7MB
        • SHA256 85f9b9525d101ba62acb3e6eb1e9d0bc5eaff13fc936cac2e2a4acbd78eb39dc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download