Overview

overview

8

Static

static

3

2026-07-12...ar.exe

windows10-2004-x64

8

2026-07-12...ar.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    150s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260710-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    12/07/2026, 09:25

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-07-12_599bf1877ea79f93a3bb38ff82f81cf9_cobalt-strike_elex_emotet_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe
  • Size 11.6MB
  • Sample260712-ld1gesfw2p
  • SHA256 214e52d2a279f1866ab38802840253046c6b5e1541cbcec19c4c76fdd5c1d4f1
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
defense_evasiondiscoverypersistenceransomware

Malware Config

Signatures

  • Drops file in Drivers directory 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Sets desktop wallpaper using registry 2 TTPs 2 IoCs
    ransomware
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies Control Panel 4 IoCs
    defense_evasion
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-07-12_599bf1877ea79f93a3bb38ff82f81cf9_cobalt-strike_elex_emotet_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-07-12_599bf1877ea79f93a3bb38ff82f81cf9_cobalt-strike_elex_emotet_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:2844
  • C:\Users\Admin\AppData\Local\Temp\2026-07-12_599bf1877ea79f93a3bb38ff82f81cf9_cobalt-strike_elex_emotet_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe
    C:\Users\Admin\AppData\Local\Temp/2026-07-12_599bf1877ea79f93a3bb38ff82f81cf9_cobalt-strike_elex_emotet_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:4196

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        AppVShNotify.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
        • Size 11.9MB
        • SHA256 bd26933a618ccbc2fcc79bd0bdf5171708fbc9398cfce2ffce965a9b717c5ca0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        InspectorOfficeGadget.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
        • Size 23.3MB
        • SHA256 9260d0ce9582a72c35ddafd98a93af1a60d8ffa5667dc3d53f0095cd62588ee6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        IntegratedOffice.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
        • Size 27.3MB
        • SHA256 a275e124cdb9cc858657b3c5df708487764f6076436e58f1def489bbab38cff7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MavInject32.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
        • Size 23.6MB
        • SHA256 6485e88378f450dbd070a39fefbbdc9a2a397ca6109abcdc97a107be0bd3fe19
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        OfficeC2RClient.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
        • Size 46.7MB
        • SHA256 09f15ffc4449ac3bdf7d91de4e2b7f5590bbcc100de710bb05db3b31aba5d8d2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appvcleaner.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
        • Size 13.7MB
        • SHA256 6ae189e7e0a2bac3154bca0413ac53d1f3cbf4ba1a4f9e15bc7b286c31c90736
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VSTOInstaller.exe
        • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
        • Size 23.3MB
        • SHA256 699449f5b85d63e5b8d35ded79871be592039555f8c374daffd184d4207593c4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        setup.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
        • Size 17.7MB
        • SHA256 6169d312c7e32aa255ec2935f4a36efb7475be8690cc1a9c2965f3017deef16b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_pwa_launcher.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 25.0MB
        • SHA256 8c93dc7ee837aeb22c53c628a5b2e06a7791d2c3443b1f24bc4808daf8a3e351
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 25.5MB
        • SHA256 ebf1ace4ab3c6efb69c498873afc1f862471180f42dce8e6c000dff48226aad1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        os_update_handler.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 13.5MB
        • SHA256 ff09940032304145b99f8826fe5b8ee44c8e4af7d559fb9862dd0787929e756a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 26.3MB
        • SHA256 153f8ae0d1cc1abe86ff353286d9b3c0dfdc4a06a57ec446467a0ce2e94d7012
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_proxy.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 24.7MB
        • SHA256 1c64472e506b3fcb6fdd2bf08aa3f73414e00c3744cd37953d4b165916e430f4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 23.3MB
        • SHA256 42226e71c4e059d87b5fbcc505407b6b8c13d0e85a1eb5b13707720e99b59ccb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 23.3MB
        • SHA256 537c22022eca67aaf1b8c05dfc761a81ab002745c6527b03d6e5564078aa62e0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 23.3MB
        • SHA256 5f683937e84ac72176c52ef1cbf029fed2645bf268dc879e49c0ecf803be15c4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 23.3MB
        • SHA256 2ee48a143d3027d7b9683d5984381fb79958abb80d1e775e4b4c70c9c2c913e2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jar.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 23.3MB
        • SHA256 c531fa48a3fd12e82fa2240a9637a74e761a06d907a13f48e70f338950c4d770
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 23.3MB
        • SHA256 037710590f7e9246607b7a0c00281391da557a99fcce8f2ff245a0781397c9a2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
        • Size 23.5MB
        • SHA256 370d24407383b3e3680c12347d601b98251517bb5cfda8259fea0cd409d9d3b3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javac.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
        • Size 23.3MB
        • SHA256 f9006e8e5dd3329d45c705a86ce731b5b793dd03a13801dfb4c58d782f72f952
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javadoc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
        • Size 23.3MB
        • SHA256 786b6281351a1fe3763b7d8608ab3f21fc3c57775e777d117d36334c020582aa
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javafxpackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
        • Size 23.4MB
        • SHA256 971136ffd341b3a277dca594d6b10bdf57cd062469a1f1cc223d7a2710a6e5a2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javah.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
        • Size 23.3MB
        • SHA256 040ba11c8b3f76613aa68f5b7c3c988b6b5a23c98fe6536faf4de0755a180674
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
        • Size 23.3MB
        • SHA256 88338faa30c07c79402a029aeecec0ed1f9f5e9cb7ca87dd2ca141d9e60f2862
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javapackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
        • Size 23.4MB
        • SHA256 da05dfe41b5d82b265fbdfaf7d9187c44e639955afb7c57b74f65bdaea18e219
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaw.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
        • Size 23.5MB
        • SHA256 aab9125c7cbc634e6b6ec4991aa37572d8983d060564d566065d02408c908c34
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
        • Size 23.7MB
        • SHA256 4d1fe3153191e8f50c93714ab46c0aada6b17957576f15de2d23c111dbc3730c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jcmd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
        • Size 23.3MB
        • SHA256 ab97d2edd1082d42ab7ab0ec14a4f0883cca2e9ffda54bd30d26a0c63eb7032d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jconsole.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
        • Size 23.3MB
        • SHA256 03019594631903600ab1a5b7e4c65a8d5dc44d65ba6972c412aac5c0ff99c5e0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdb.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
        • Size 23.3MB
        • SHA256 f885c08128fd42e2f3edd43f1756c7dfed254a77e081bfb19994a9c3f0909b7b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdeps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
        • Size 23.3MB
        • SHA256 a8673884826aca70bb301805f0cc3ebba9671a962521e98c5bdbff44b82034e9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jhat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
        • Size 23.3MB
        • SHA256 0c1a77c199aad56478d9c79bb2d50df18d495643d0b44f3ff98e97e9462b370c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jinfo.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
        • Size 23.3MB
        • SHA256 49200d628616516ab840d2da265a591a00b00a5c03e7e2ca89595f87c26a5a0c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jjs.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
        • Size 23.3MB
        • SHA256 299904f8d91339ac45f813b2e076a1abefda5853dc0cf6d14e62295cb2578312
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jmap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
        • Size 23.3MB
        • SHA256 24e7972c70342e85ada912f446fdd4f68986bad61bfa498fb7afcd0314f48165
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
        • Size 23.3MB
        • SHA256 9c1e08d69faa80120e50fbdfd04a0b1077d01b1b8ec6f233dde1bbd081937979
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jrunscript.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
        • Size 23.3MB
        • SHA256 45df12d3d468540de11794f89c47156f5d826c451130aa6b79a0ab6acaf604d7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jsadebugd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
        • Size 23.3MB
        • SHA256 d3abbc1d07b60d00c872418407a7a5e3f2885d95a7f916af5ed7311e28275686
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstack.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
        • Size 23.3MB
        • SHA256 6ee64caedd97fbf5bb75cdb6a5d692eab35bf679c143c3402af2676e50962636
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
        • Size 23.3MB
        • SHA256 c8a0e9ecaa4c07dc703a9eb904ae9f1fe67bf39cc16c70bedd0162e15e67bdd2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstatd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
        • Size 23.3MB
        • SHA256 325d3528b3d7056f920b41bd39efe415772094dfbde9ac406dcc4976cbb135d9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        keytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
        • Size 23.3MB
        • SHA256 47931ab230ce91f6740c68ca88b46a63db7f11f3df6dd6bf8c2b493953ed0dc6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        kinit.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
        • Size 23.3MB
        • SHA256 3cd5da71e9f3214da567e39260d876ad3882176052ad085b68f841f88deef3c7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        klist.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
        • Size 23.3MB
        • SHA256 f74d20cc959ba5d7ea4aacfc808a8e693ec16451ebdbe0d3bd4c0acdec086816
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ktab.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
        • Size 23.3MB
        • SHA256 d4bb8beeffc3edfa6d0cce6b4423bcc7faa7a22967f456137088a0745924e501
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        native2ascii.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
        • Size 23.3MB
        • SHA256 97812c175369d5867d2aa31ba853645c3e4afeb809bd7908f0d6d02c7b4b31c6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        orbd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
        • Size 23.3MB
        • SHA256 513ea72a63bbe6f0142b32aa04f996eb4b4663551b9b0d985968906cf03c2545
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
        • Size 23.3MB
        • SHA256 b37e3f9d24a4aef71458504f03ef06f8619e8224911ab66f84d763f156c8c022
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        policytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
        • Size 23.3MB
        • SHA256 7c55d199d164c43c809deaf939d3f41f05681230c93a0c3b05d88252b53876f1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmic.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
        • Size 23.3MB
        • SHA256 29a1d8a82a19b9def7bbf87ce7e3494f678719ee262e0f6d21363f9115af9edc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmid.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
        • Size 23.3MB
        • SHA256 6db4fb9bd5ec8456a87d271a49607054e095dbade717d5d8425d4f19fc452176
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmiregistry.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
        • Size 23.3MB
        • SHA256 250d5c9f998297d71a501ecaba6f2779e77b8959cf9cec4cee25dcbe12901ace
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        schemagen.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
        • Size 23.3MB
        • SHA256 1f3ae3c4f6d1ab33b08812bf3fc1a1ace61ee1b8a4bab852a6e8a4ef1870f109
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        serialver.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
        • Size 23.3MB
        • SHA256 da4d808ab309e5d86ba3fe45f5ac4be0c25bedec307581dc87ff979929234346
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        servertool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
        • Size 23.3MB
        • SHA256 197ef330c28ab66cf1ff27039d900a914e90ccb7b2ab2bf17adad57c41eaabbd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        tnameserv.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
        • Size 23.3MB
        • SHA256 c364c463b96abb6fb1ae648c393a8099c7217ef76f56c8da7577636cdca55937
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        unpack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\unpack200.exe
        • Size 23.5MB
        • SHA256 4da07f0f8c2d05aac8efd9d997d97a3512bf3039470a07bd3106eee1a3afa27f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dotnet.exe
        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 23.4MB
        • SHA256 89af6545e3996b15072af7f70dc8757f59f1ea88dc202f792468ad2d7c4e960d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 23.3MB
        • SHA256 16ebb423f487af77dc34821defcb930e2888b27a3029cfe9c7567bfd65a68c26
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 23.3MB
        • SHA256 7ac4e8846927bbcb5b3017ba7a69d3bcec08c3f6b57ae165e4b1e7ef517157b6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 23.3MB
        • SHA256 598b91d4706e7ef4e394af05168b9839bec463a858c8d6555d9b9299043f744b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download