Overview

overview

8

Static

static

3

2026-07-12...ar.exe

windows10-2004-x64

8

2026-07-12...ar.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    150s
  • max time network
    109s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    12/07/2026, 13:46

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-07-12_31b2156428624afae45e75be297859ca_cobalt-strike_elex_emotet_icedid_luca-stealer_njrat_remcos_stealc_vidar.exe
  • Size 7.6MB
  • Sample260712-q3engac12x
  • SHA256 0026f48af318d2059ab486346014cd42f4549676f2a25fab9faae216e7dc81c3
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
defense_evasiondiscoverypersistenceransomware

Malware Config

Signatures

  • Drops file in Drivers directory 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Sets desktop wallpaper using registry 2 TTPs 2 IoCs
    ransomware
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies Control Panel 4 IoCs
    defense_evasion
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-07-12_31b2156428624afae45e75be297859ca_cobalt-strike_elex_emotet_icedid_luca-stealer_njrat_remcos_stealc_vidar.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-07-12_31b2156428624afae45e75be297859ca_cobalt-strike_elex_emotet_icedid_luca-stealer_njrat_remcos_stealc_vidar.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:5572
  • C:\Users\Admin\AppData\Local\Temp\2026-07-12_31b2156428624afae45e75be297859ca_cobalt-strike_elex_emotet_icedid_luca-stealer_njrat_remcos_stealc_vidar.exe
    C:\Users\Admin\AppData\Local\Temp/2026-07-12_31b2156428624afae45e75be297859ca_cobalt-strike_elex_emotet_icedid_luca-stealer_njrat_remcos_stealc_vidar.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:4120

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        7zG.exe
        • Path C:\Program Files\7-Zip\7zG.exe
        • Size 8.2MB
        • SHA256 a9597b32ddb43ca5537ce5c824535b5b6b18ea143a6112287d3f0e9e85c4624c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Uninstall.exe
        • Path C:\Program Files\7-Zip\Uninstall.exe
        • Size 15.1MB
        • SHA256 e3ac30026b49094e506f1b5f8295ebb5f3a62a9742d47c82606a833adf5e8066
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        AppVShNotify.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
        • Size 15.4MB
        • SHA256 5f766c68cf9401dbac79f64339e523255fb8a51024db1f877e85b624f1ee2bc7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        InspectorOfficeGadget.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
        • Size 15.2MB
        • SHA256 7a3654cc209d392148eb3c247e9f447c8e664f81c3ed71e217b5eaec70e4ec5c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        IntegratedOffice.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
        • Size 19.2MB
        • SHA256 981bbd6bddeab4e4fef3386049f7970273970e9834000fb2383c09dd65a70d18
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MavInject32.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
        • Size 15.5MB
        • SHA256 829f4c873ab34f6a945f768e813a1a9341f6120135aa832f3bde70afe94baa8c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        OfficeC2RClient.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
        • Size 38.6MB
        • SHA256 ebbba5b8d110f4a259c7dc1dfa49d2dbdd5721fc213193e7d032ee570c0a0707
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appvcleaner.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
        • Size 17.3MB
        • SHA256 225f7cfed3ed58d518534cf226c4cc451017fe222cba6090da1f2266efd97cc0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrmstp.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        • Size 21.2MB
        • SHA256 c55cbc577f88fe4e78ea446d2139d1983d6f801cf525d254de91f8116f440f63
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_pwa_launcher.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 16.8MB
        • SHA256 1052e896353e990e1e6ab3581b55b57bab22a6e3997871011bfa026b25004adb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevated_tracing_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 18.6MB
        • SHA256 40fbeb92badcd8d39c9b285f276bad675e45d1086c8d8ed88461c9948d516a75
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 17.4MB
        • SHA256 f02cad98f1cfa63a525a7822e17111dfad58dcb6bdc8a7ef04d466db1122d86e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notification_helper.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 16.8MB
        • SHA256 a860584e0ebbf6ba1f43895a1fcede28a9ef29a5dbff3d34c22229c4a9136cdf
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 18.2MB
        • SHA256 522fd05367b91e7b05333ffaabd2b39426206de30a3c83aa038229e555613c9a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_proxy.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 16.6MB
        • SHA256 1b8b67e7e48890602e5f9632afc32e346cb81bd0ff1ca4379312ee51266a3248
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 15.2MB
        • SHA256 b961449175ecacacb16fdccb0a18c4c9fb22b770f4722616d819e2ffdb27af56
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 15.2MB
        • SHA256 8087a3e2ecd308eca16e358d7a58123a5b459758b3b70c52d7682bbb0b712c70
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 15.2MB
        • SHA256 c4feee3a980022939bb2e2a524c9a7f447810f36aa9d7043e73883ac571da10d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jar.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 15.2MB
        • SHA256 609d20e38d34d48fda811ef794b00008c8c2dd9eae10f63eb07abb35709d5bb9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jarsigner.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        • Size 15.2MB
        • SHA256 c80d7e2ac2f2489409c75f2e90b4b1df8dec5afa89b91da2f36cca8bbe2bf027
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 15.2MB
        • SHA256 f4aa3632c4a7684267136ac04710347e96e51446d0b09e491f37668f6619cde2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
        • Size 15.4MB
        • SHA256 657b6b0f9fe350dae337d25b5daf6ef3f4d653c8a1959f921413d131566367a5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javac.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
        • Size 15.2MB
        • SHA256 46a5e7626526e6bab19b99177eff07818389876792297270841db7b45da4e78c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javadoc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
        • Size 15.2MB
        • SHA256 547cfe6a62545206237dce79f9e489c2ccf6e200830d3408e67751bbbb4b6eeb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javafxpackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
        • Size 15.3MB
        • SHA256 1fad4330d7ac69c5cff83645bedba9cd475d7b5f152398cb91afa21189cd8776
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javah.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
        • Size 15.2MB
        • SHA256 c5b3602cf71eaf50a41b31be0f01375daa9fc25b2f62fb2154cce4fb86213e2a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
        • Size 15.2MB
        • SHA256 1a74016366f3492d3628931b138dbee6ec53f434a892f283cffd79ee5b0c46c1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
        • Size 15.6MB
        • SHA256 81ae7863772778e7d681025fb1bc27313c1998df17df606a2dd6e01926f7fbd5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jcmd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
        • Size 15.2MB
        • SHA256 38cd4e2842f1fad39eb13c1ba7eaf963c6adf42cab46a11c75300bb5a258997e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jconsole.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
        • Size 15.2MB
        • SHA256 a04bbc41fc8d69bf7434a9438b9f96acc10274592d285bae9768947a8cf069ee
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdb.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
        • Size 15.2MB
        • SHA256 09164cbc4bacdf9a787fffbc8c9012018663fe02911b91bcd9cd684cad031bb4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdeps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
        • Size 15.2MB
        • SHA256 09612b0b29aa15130aa5efeb9dde0d9545a097a150fa3e7414c7a37353303629
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jhat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
        • Size 15.2MB
        • SHA256 40c709de0d590a9d52c3de34350800a86608177bcdebec4a47bb0af716a5e454
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jinfo.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
        • Size 15.2MB
        • SHA256 be6b8940d4dd84e73775991e718a95f02b0514e2935db10cd2d001a4ff928d04
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jjs.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
        • Size 15.2MB
        • SHA256 37f408c6ce604dc8c544cd8abc802dff44327beb7447bbeaeb35cf568c8da82f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jmap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
        • Size 15.2MB
        • SHA256 2c46512ada635cb10eff34b1224bf8836c453331a207cd9cd612efde3fa27ffb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
        • Size 15.2MB
        • SHA256 e96df9501033ec68afef90231bee18b71ff3a121d3c18cf14b60abf3911d7f5f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jsadebugd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
        • Size 15.2MB
        • SHA256 786f12f2044dd4fb401d0f8a50ac6351b3499b1934a3e830a72d4da836168848
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstack.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
        • Size 15.2MB
        • SHA256 e980ca6f22a8dfbc0116a7ecd5063419e214be011e4a32020ff6aa5a1ae3f787
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
        • Size 15.2MB
        • SHA256 6c9940e16ed45d25c0a9e2aa23e35ec65a6c81f52a62fd82d8b6505f74a9e449
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstatd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
        • Size 15.2MB
        • SHA256 1c5236afd6e097f03690d5663a1fe5d0575281d8c8d58e8fc222cb01103d21a4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        keytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
        • Size 15.2MB
        • SHA256 70cf21f5ebe3ddabebdb17f48a526a9b083b067456f979f4061cda302c2e0aeb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        kinit.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
        • Size 15.2MB
        • SHA256 2ce29825d65a8de511eb33bc0915bade332a1256ec0dc1625b7ad6a2f4044d8b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        klist.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
        • Size 15.2MB
        • SHA256 f9e4dccb5a8c00f6f09fb10853da01538e8cfb71f4b85ad7ec52107a2149ef0b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ktab.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
        • Size 15.2MB
        • SHA256 f4e00dc90f231a074abd026a36a2778a96fbe4d2a00fc46d93c4d7f0f2be7773
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        native2ascii.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
        • Size 15.2MB
        • SHA256 58554b457633d9a241539fd63c41b2e863c3864e42dd5974eb3164b6e985018e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        orbd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
        • Size 15.2MB
        • SHA256 a9d384c9a0fc3b8ee4c056740f4173fafeddeb72589659fd478d1190894e4ab4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
        • Size 15.2MB
        • SHA256 96cc8d0bb8a73a459935b655a73be75919a0d00a457569b6594b935faa813114
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        policytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
        • Size 15.2MB
        • SHA256 106505a6edae1123d4f9f0bc36225be3591c0c0866f4d46af9f8b64ee88ca939
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmic.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
        • Size 15.2MB
        • SHA256 c0504cb4be633abb50ad048a495f222a560df6435bef0cc2da64027c8623a555
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmid.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
        • Size 15.2MB
        • SHA256 e2d9a2f370d67391833377831c67d51d180fa24eff84065360507ed734f402d7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmiregistry.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
        • Size 15.2MB
        • SHA256 f66b97b66336f3f52dbf030369ee1650f94b5206693df884f80f2acaae5c4ff1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        schemagen.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
        • Size 15.2MB
        • SHA256 f138ceb35b7b5c10b1172d0ef8b7116c5d52f1b95d51a99c0937b325db42ade0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 15.2MB
        • SHA256 18c1a9d776cffc46d7855551da0202268cf79c05fdcd84d0f182aceb2cd384a6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 15.2MB
        • SHA256 88ecfb8e1bf678e3a886a3625bdecde1ba374cb7ebe4ac05beeec8fe8d069d7a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/4120-2-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download

        memory/5572-0-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download

        memory/5572-1-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download