Overview

overview

8

Static

static

3

2026-07-19...ar.exe

windows10-2004-x64

8

2026-07-19...ar.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    149s
  • max time network
    141s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    19/07/2026, 23:49

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-07-19_023205bc35f61cd66ba7d4ceddfda5e7_cobalt-strike_elex_emotet_glassworm_icedid_remcos_vidar.exe
  • Size 9.8MB
  • Sample260719-3vc6wsbx2w
  • SHA256 26acfdc69ccd81f7e864f62a7df9390805d82e7e88d6c2edbaaf2b4825e17028
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
defense_evasiondiscoverypersistenceransomware

Malware Config

Signatures

  • Drops file in Drivers directory 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Sets desktop wallpaper using registry 2 TTPs 2 IoCs
    ransomware
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies Control Panel 4 IoCs
    defense_evasion
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-07-19_023205bc35f61cd66ba7d4ceddfda5e7_cobalt-strike_elex_emotet_glassworm_icedid_remcos_vidar.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-07-19_023205bc35f61cd66ba7d4ceddfda5e7_cobalt-strike_elex_emotet_glassworm_icedid_remcos_vidar.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:1528
  • C:\Users\Admin\AppData\Local\Temp\2026-07-19_023205bc35f61cd66ba7d4ceddfda5e7_cobalt-strike_elex_emotet_glassworm_icedid_remcos_vidar.exe
    C:\Users\Admin\AppData\Local\Temp/2026-07-19_023205bc35f61cd66ba7d4ceddfda5e7_cobalt-strike_elex_emotet_glassworm_icedid_remcos_vidar.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:4776

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        7z.exe
        • Path C:\Program Files\7-Zip\7z.exe
        • Size 10.3MB
        • SHA256 3276441c5f69aa486eb8cc7a440f83ec106c9f977253a44a6a2df86c73c47131
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        7zFM.exe
        • Path C:\Program Files\7-Zip\7zFM.exe
        • Size 10.7MB
        • SHA256 6ccc171f1370f870a25e6912ae3385a9c0485f1c5c050b1c0a5722818c9861a3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        7zG.exe
        • Path C:\Program Files\7-Zip\7zG.exe
        • Size 10.4MB
        • SHA256 17de360b814243521ca72d7b7c4fbf9b7d89e08830d42c7681283a7178efb39d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        AppVShNotify.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
        • Size 19.8MB
        • SHA256 d9a228f86c594d950325803ef5480759c0650e672265a5cc4bc6b8ca62b3a3f7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        InspectorOfficeGadget.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
        • Size 19.6MB
        • SHA256 08c16da4a5e41b3683df0b75442c9c29e789439e99ddc4922614b4ddff2b6e83
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        IntegratedOffice.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
        • Size 23.6MB
        • SHA256 763aef157525cbc11c6222f085f8e3146958583a3467efff4728ad47f570a190
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MavInject32.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
        • Size 19.9MB
        • SHA256 263d754dd13f7a1d83a47e2d7a22b69d1236e8ff6eeca1ed2ac0b19a0e342f19
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        OfficeC2RClient.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
        • Size 43.0MB
        • SHA256 f10a1c079d7767f0f2056409c28a738b59faea091661d8626fb1c8af05d42e8c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appvcleaner.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
        • Size 21.6MB
        • SHA256 b72f5ac2d17370db62241c2ac2bb92adecccad6a95366d87cdcd876460e20df1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VSTOInstaller.exe
        • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
        • Size 19.6MB
        • SHA256 2b193c2b4a16a667b8a6e9d2e7547a8c112b23b0ad256634a05266bee25543a3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrmstp.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        • Size 25.6MB
        • SHA256 44a73d64890f24563cbb4c24c2fe03d1235dd76e7245ab1e584ea6497c859a7e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_pwa_launcher.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 21.2MB
        • SHA256 1780d1984c63eabe494808cf5eabd8266ed6b611f62df5edc0fba4e30059e0a3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevated_tracing_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 23.0MB
        • SHA256 d40ba303bfdbbc09b6959460aedfce684451f88ed5f7932355f90be60e758275
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 21.8MB
        • SHA256 b18fdf7c6bdf61d9c29e44f3194e9cb1261489b4cd3d3c153217bf87b69ee37f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notification_helper.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 21.1MB
        • SHA256 9a2107f44aea27a2945076058ead92964c3fb1d007672fb7e9fedd4c030dd538
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        os_update_handler.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 21.4MB
        • SHA256 aa6d45276319c75c8b5472dd5d1c30794d05c7639136a5e971e308835c28e92f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 22.6MB
        • SHA256 a6e5f10ea14484784c42f36eff87c875de5fece780d668029259eda91b5456b7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_proxy.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 20.9MB
        • SHA256 a725b8878d7b05df7cb5e62f3b036b6a817f2538c23e1f00b81cadf01d3a901e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 19.5MB
        • SHA256 49d516b696a0dca3cb6f57c0249309d8c6168183ebc3684bc59a52f6b73f3f51
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 19.5MB
        • SHA256 da6b06b06d510e68f6a9b41dc8f4ce494063b0884f13d338c0eb882a0d2cedfc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 19.5MB
        • SHA256 3110d6db5078495faad008bc15acde1a105b3039a14272a2f055346e574b8d63
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 19.6MB
        • SHA256 30d82ed18537057c73478741f347abdf394a52df74f5abc7117aad63b6e19f97
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jar.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 19.5MB
        • SHA256 979b4a3204ed43ec46fe2a1e02a404bc0def3e13af1cbb225874a721c462e56a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jarsigner.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        • Size 19.5MB
        • SHA256 57c4431965aeedb977cf5798f50bf7e71c71c5742f153ae886e45be2fa434f01
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 19.5MB
        • SHA256 6ce5f660e8d50c84e5b33af8860559d48133366ca8be9f617140627e0f57439c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
        • Size 19.8MB
        • SHA256 05d23944a091cb479a83f2fc190f12756eb5029d45cbe4c665af161eb8544807
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javac.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
        • Size 19.5MB
        • SHA256 6547667dcf8bebcb4c45f409146e3cc12b66a60660d5f3a2b6cddcc9de4d7f37
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javadoc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
        • Size 19.5MB
        • SHA256 c151e893f2502e84eb5e3e6c4612ea7defadfde4182e2bb4b1f78230d360c289
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javafxpackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
        • Size 19.7MB
        • SHA256 a08715efae0a448fd9c4fd6b8332e307baa68937ec438b3929d3ab3cbeca30ee
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javah.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
        • Size 19.5MB
        • SHA256 670b3109296a1c27ecefc220480af27539bf661d10d4b4889b513426ac03ab9e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
        • Size 19.5MB
        • SHA256 1881cc9b345fb0e4545e9a6bd71a3fe6a86f174efc09a82ec248885114c10fbd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javapackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
        • Size 19.7MB
        • SHA256 048b2f9a927c96b1dca41f8faca26d3ed66cc0c6a602865afb3704a5634fb9a9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaw.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
        • Size 19.8MB
        • SHA256 565f0b391ac4bf50e5fb0afb0219ee08183fedc8d5cb1566137cbba84f058def
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
        • Size 20.0MB
        • SHA256 e7280ca5914149347f93f5cfda4b05ea576ca0654d8199385bc3b194d3e23e43
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jcmd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
        • Size 19.5MB
        • SHA256 be7c6d4bac3cde76d9b5639e47f024f2a9c870c1579c9d652b1cd4f9307e55a1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jconsole.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
        • Size 19.5MB
        • SHA256 dbca8f916359d60fdf076aa302052117727ab3fb77fd55bc63fdf5056618e15d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdb.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
        • Size 19.5MB
        • SHA256 8cf8bbfe0d6123093f528b150204bbefe74f02ab22500b47c2466e59ed62263d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdeps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
        • Size 19.5MB
        • SHA256 b2679551e68ed69d4cb940226670bb302411861ab3aa813856d9054ab0582551
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jhat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
        • Size 19.5MB
        • SHA256 85e6db643636f61afcd862bfe1f8cc6538ada6d3a63836b6e0f42dc6336e2d1f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jinfo.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
        • Size 19.5MB
        • SHA256 a21c57ecb9195480c0dff2980a6b3fb6a26d2611c4dcf5689815b621df206fd6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jjs.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
        • Size 19.5MB
        • SHA256 3351f4ea3886b82b9aee14a1530c6e0755a9366953852b2c36b6df0db1bb1245
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jmap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
        • Size 19.5MB
        • SHA256 de51a4f7f3574364e37b5afaf7cc9155e54d1e1c900d942be77d59b9a38cd84a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
        • Size 19.5MB
        • SHA256 54be04cfd7b4cf3bc3ae590db127ab8b043e61324656927db6e57d9f4667eb68
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jrunscript.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
        • Size 19.5MB
        • SHA256 42cc58df53ad6b60da66f3ec936e56a6a0d852f9a1120146ffc4c63bf7913670
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jsadebugd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
        • Size 19.5MB
        • SHA256 9bd5ac6bd72d9737ee6c7975041f14be8eee59507458c49a3f83aae47b5d9fb0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstack.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
        • Size 19.5MB
        • SHA256 912b01a9eed17d261f93002dfb41238d611ceaa5f4e7b223f4a80ba8d097d5cf
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
        • Size 19.5MB
        • SHA256 16273e165f41abe1348c5feb3bc608ad2c9b6ccbfae5906fed21376c22e2a11c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstatd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
        • Size 19.5MB
        • SHA256 916c6a16155d3214b5a2a94e8db6df51fb2d975c42cc3ccea1ecde2c63d8ccbb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        keytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
        • Size 19.5MB
        • SHA256 3ca231e2fbd5d596c9e529b0ccf59df5dcb2822ca62fcbc49dae20f1ef10196d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        kinit.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
        • Size 19.5MB
        • SHA256 fbe2342fb7181984d008a7a12bd377921247184e11aa158e269fbd2e601cdc18
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        klist.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
        • Size 19.5MB
        • SHA256 e2d012df93923a16d0430198b52a43a5fe190b98ebd9a667a9367d99aa241129
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ktab.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
        • Size 19.5MB
        • SHA256 a31946ce06c8953ea8034e10aecf50d8003a23770e3cb35229b64a048f7fb4f9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        native2ascii.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
        • Size 19.5MB
        • SHA256 a72be5a610539ba2ee182ba737273f7d265d3ee84de088ca79b10c3fe7076de0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        orbd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
        • Size 19.5MB
        • SHA256 65e982436568aa973cfedee37ad961d48098595e917886f6497b83884d981ded
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
        • Size 19.5MB
        • SHA256 cecd793f3465d868e55c8ff179867a41cedc60e6bd835007a8d48ae9d4fceb8f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        policytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
        • Size 19.5MB
        • SHA256 97db27fb2f6b0c0fdeb3a84acef2849fa6029e2357f82b7cd7a5de8aef5924b1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmic.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
        • Size 19.5MB
        • SHA256 9e8fd6ae0e2a44f633569757c2201bf4faf7759938acced7bffe78bb2d7d4e4b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmid.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
        • Size 19.5MB
        • SHA256 d8778c40ccdd3b934038d5acda92c7fe1e9cc399aed1b01e8b3163bf67dcd2a4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dotnet.exe
        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 19.7MB
        • SHA256 67cdaad017b16e40939b12e3bedee3a7a21edd29dd63d70897001d51150f83f3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 19.6MB
        • SHA256 8c187425eb636a3a31055bd1419150477e2b13d3911cb51e0ab81b6f160412e3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 19.6MB
        • SHA256 2d78acfaa43bd35209a8d6efa19ea7b9c4c29762afccbcc95f211872672774c0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download