Overview

overview

8

Static

static

3

2026-07-19...ar.exe

windows10-2004-x64

8

2026-07-19...ar.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    150s
  • max time network
    134s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260710-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    19/07/2026, 22:30

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-07-19_5d6be0ad6fa6e3dcbd2363f5f4473f2e_cobalt-strike_elex_emotet_icedid_remcos_vidar.exe
  • Size 22.4MB
  • Sample260719-2e2c4ses4l
  • SHA256 a7f1b34fcb8015c4ce168e10fa6225a6e2705ce71324f2248015944473630670
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
defense_evasiondiscoverypersistenceransomware

Malware Config

Signatures

  • Drops file in Drivers directory 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Sets desktop wallpaper using registry 2 TTPs 2 IoCs
    ransomware
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies Control Panel 4 IoCs
    defense_evasion
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-07-19_5d6be0ad6fa6e3dcbd2363f5f4473f2e_cobalt-strike_elex_emotet_icedid_remcos_vidar.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-07-19_5d6be0ad6fa6e3dcbd2363f5f4473f2e_cobalt-strike_elex_emotet_icedid_remcos_vidar.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:1248
  • C:\Users\Admin\AppData\Local\Temp\2026-07-19_5d6be0ad6fa6e3dcbd2363f5f4473f2e_cobalt-strike_elex_emotet_icedid_remcos_vidar.exe
    C:\Users\Admin\AppData\Local\Temp/2026-07-19_5d6be0ad6fa6e3dcbd2363f5f4473f2e_cobalt-strike_elex_emotet_icedid_remcos_vidar.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:5696

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        AppVShNotify.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
        • Size 22.7MB
        • SHA256 5bc527780b02ce070fde1f816a994cfe46f745c00b9d179e048927191ccd5130
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        InspectorOfficeGadget.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
        • Size 44.9MB
        • SHA256 6a60136fab835c6a6cdf81d7ea354ae1c0ee8d1b59d5861445cd173426aa365e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MavInject32.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
        • Size 22.8MB
        • SHA256 49ecf7166d42df01ed6de165ea5dbb6e2c7629fbf510d6dc42c955d849095657
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        OfficeC2RClient.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
        • Size 45.9MB
        • SHA256 6493ebe1d60cf0221b6169fcf17cd24ff742ffabc6ebc2fbd07eaac4dc0cc49c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appvcleaner.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
        • Size 24.5MB
        • SHA256 5a0c0f9422c952c9fd6f024618f790b1e1d31aaa5b3e147b4e82bb598b45bc53
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VSTOInstaller.exe
        • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
        • Size 44.9MB
        • SHA256 32678859a1056b9019be1da244bbc64d9e795f4ebbdd41d5bb1d089f49e71bcd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevated_tracing_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 48.3MB
        • SHA256 1d7c75916ff107c978e82735045944d5a9fbe9c502073b1e6ae4fa0654412e62
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 47.1MB
        • SHA256 3642b50ae1386509988e3335420ad6585c53129358ab071ff03fd2c0fd817ae7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        os_update_handler.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 46.7MB
        • SHA256 db32dae046e753b2512eccd042afe137d04af633eb4045ec85cdef4ab2390993
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 44.9MB
        • SHA256 2decc2eb6f137c627e520f3150336f56a7ee6b76d1ce22a93aed8a1a5a406fe2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 44.9MB
        • SHA256 77b3cdd95f8561556778f8a922e792f2c4b4548f6df36d4d537f5431bdbf7e22
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javac.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
        • Size 44.9MB
        • SHA256 038f3fbf792814d6b4a46fe16492aea13a9f413605f2a97c92d954925db96ae0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javafxpackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
        • Size 45.0MB
        • SHA256 6a2debf3133ecfd02c980a6f252744ed281a2343bbc1d1cf6fd8011dcba217a0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javah.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
        • Size 44.9MB
        • SHA256 a8a0f7ed29772493678794bd03cfe2b17380e1b521db9661222dafa046255667
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
        • Size 44.9MB
        • SHA256 067b639663569338554c6f74293577c4d2ce4131056a54fb078da555927014eb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdb.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
        • Size 44.9MB
        • SHA256 0dab61cf950fb66adb4f42c06e2c95e5f03d41767bf9be9818c7a41522394796
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jhat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
        • Size 44.9MB
        • SHA256 cde18435e019de6905cfa91403994831dab5c4dbfff3d0568614eca2b7ad6568
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jjs.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
        • Size 44.9MB
        • SHA256 72059ce8273f2d03ee52663ec5be671aacd980b17906efd9b271252bc32fcdc0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jmap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
        • Size 44.9MB
        • SHA256 695c551eea415c4f3427ee635a0cb066d7db80ffb6849c84789caac934e21173
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
        • Size 44.9MB
        • SHA256 e2828ae4fd132d4834d4826e229d17764ffc8bbb9c4e83b76776dd6c4fdeac81
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jsadebugd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
        • Size 44.9MB
        • SHA256 703bd83e389c6e984f9c0d4cf0bad182172edbe2c68757df98185745aa87b886
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstack.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
        • Size 44.9MB
        • SHA256 de313cce00ff7a606c790488fa8ca2d759ace955297ed2897c14525f9a470406
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
        • Size 44.9MB
        • SHA256 1620dc454f9de7d3ff86cfb172f500b7b1dc5ecddfca3ce0d7f38dfc4c936530
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        keytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
        • Size 44.9MB
        • SHA256 dae31e5d3807ff0e52eef9219f1116e1071e366cb428afcbf65bb56ba0d2e42d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        kinit.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
        • Size 44.9MB
        • SHA256 327730cb96a28b39c9b06be04d5d0a11fe14936b04abbcb2bc01a521714601e8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        klist.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
        • Size 44.9MB
        • SHA256 28cb72ccbb8d69f648174349b4624bd09f7eda9b01680b863766ed1cf68e198c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ktab.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
        • Size 44.9MB
        • SHA256 246340cdaf9bac2f5d72beb6139fe09d59a53101e737be9ca6bace985d7de2ce
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        native2ascii.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
        • Size 44.9MB
        • SHA256 57c03be2536ce72e379a1850f549415c6794ac28a9e42c026159657e7de31bc0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        orbd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
        • Size 44.9MB
        • SHA256 1649e78e83897405ea6576caca813cc8d67101f481c7c1d54470785e252f1f2e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
        • Size 44.9MB
        • SHA256 7fb316e12b2e5c58c587a605cdcd674cdcfd32868a0d2a01fa11a9e624563db3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        policytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
        • Size 44.9MB
        • SHA256 6b17362faa3334a24ce5ba4df0b2f93a9bdaa245254b3862d3f9f3e52f86cc9a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmic.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
        • Size 44.9MB
        • SHA256 c5c900f1f178441e9b0d21e1ea6b5dd09d57f4a838b343b8d29433b13b742e65
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmid.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
        • Size 44.9MB
        • SHA256 97cd28b9e65c4900fc9d8998624a0a4a74bb37513f6d9de604c77f85c4476aae
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        serialver.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
        • Size 44.9MB
        • SHA256 0a4657d411a28d796a97b8056e8f297fd517250e9ccd79821b8643f6deffbf4f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        servertool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
        • Size 44.9MB
        • SHA256 6806a31e5d9ff585b50268e151555229add4a6ae837b7010ca1191e39fb5af74
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        tnameserv.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
        • Size 44.9MB
        • SHA256 1d85a41af426e57aa2f6c52707e3188a03660b0e5a34d602f984e8b492d8fb04
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        unpack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\unpack200.exe
        • Size 45.1MB
        • SHA256 1e4eadd41e67fee5f7025ada87eb1b3c110b743d09f5d0edcc3c9c503b01e362
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dotnet.exe
        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 45.0MB
        • SHA256 dd27c4151480f78ec454f6e69065e2e64e143f3f599a0a00cc6ab347d8e2de19
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 22.5MB
        • SHA256 152e28b6dae5e727339c982bd27b5129a9cccceb8bd1f666bf53425541fe39e3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 44.9MB
        • SHA256 59970606912a044f5b4c999c5a4586920b31a99f8d65f86a7fca17edf738e348
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 44.9MB
        • SHA256 68042dab9dffef527c949c86d88f17aabdb561a714baefa09af8b3b822c6018d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download