Overview

overview

8

Static

static

3

2026-07-19...ar.exe

windows10-2004-x64

8

2026-07-19...ar.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    150s
  • max time network
    133s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260710-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    19/07/2026, 21:01

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-07-19_d4d11902b131e588abf22e19cb64567b_cobalt-strike_elex_emotet_glassworm_icedid_remcos_vidar.exe
  • Size 13.3MB
  • Sample260719-ztzfysfs21
  • SHA256 392dbdf7cf623aa971cefe372dd13864a4a0d1ffc8a9ea2408ee5462a35b1811
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
defense_evasiondiscoverypersistenceransomware

Malware Config

Signatures

  • Drops file in Drivers directory 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Sets desktop wallpaper using registry 2 TTPs 2 IoCs
    ransomware
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies Control Panel 4 IoCs
    defense_evasion
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-07-19_d4d11902b131e588abf22e19cb64567b_cobalt-strike_elex_emotet_glassworm_icedid_remcos_vidar.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-07-19_d4d11902b131e588abf22e19cb64567b_cobalt-strike_elex_emotet_glassworm_icedid_remcos_vidar.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:5152
  • C:\Users\Admin\AppData\Local\Temp\2026-07-19_d4d11902b131e588abf22e19cb64567b_cobalt-strike_elex_emotet_glassworm_icedid_remcos_vidar.exe
    C:\Users\Admin\AppData\Local\Temp/2026-07-19_d4d11902b131e588abf22e19cb64567b_cobalt-strike_elex_emotet_glassworm_icedid_remcos_vidar.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:2976

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        7z.exe
        • Path C:\Program Files\7-Zip\7z.exe
        • Size 13.8MB
        • SHA256 995dc25052de45da6ecb44433cec534b4291433d122a1a37c0057d08fe880987
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        7zFM.exe
        • Path C:\Program Files\7-Zip\7zFM.exe
        • Size 14.3MB
        • SHA256 9da54c75692941bcc0f3b9021a3110ca7c4a31cd679f1b9f44a0f56e6b466e92
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        7zG.exe
        • Path C:\Program Files\7-Zip\7zG.exe
        • Size 27.3MB
        • SHA256 6804ad97f0fb6276a28f752bae2c335134547d9e8019a04600ee34ee86f81bf2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Uninstall.exe
        • Path C:\Program Files\7-Zip\Uninstall.exe
        • Size 26.6MB
        • SHA256 0e5dc336f1836f2873234423fec40264be3c99b3602a37f6cb70d58a0137b064
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        IntegratedOffice.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
        • Size 17.4MB
        • SHA256 396d09768c23d0c646078a6c97b637c00dc5c42b5eb2336d47e55f1f9936226d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MavInject32.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
        • Size 27.0MB
        • SHA256 6697e6d5955e619afe1a08107a56873d8af7c9ebd4dc8a4e8d6d4530e9485a9b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appvcleaner.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
        • Size 28.7MB
        • SHA256 fdc959c9ea30fb21342d2d3207f7e1cff1b74ba0771c803734bb2345834471b1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VSTOInstaller.exe
        • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
        • Size 26.7MB
        • SHA256 93e99f7b96ae149c49d242536e4b0ffe2a9e96b0e2b1641a3f1d4758401b4f90
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        EnterDisconnect.exe
        • Path C:\Program Files\EnterDisconnect.exe
        • Size 26.9MB
        • SHA256 673c9201d2f59c4427c20eed4d3928874d178dc6a18e4ccccca37ed4217af175
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrmstp.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        • Size 19.4MB
        • SHA256 d1bf1e5f0d71ffbd2f3a1c2593c1b9819b48d9796c1a0c0d727148d389d1d588
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        setup.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
        • Size 32.7MB
        • SHA256 3547e4d473a65ca52a5f7d62c41f9daf657d422b74cf3c5c9e2138efaf9d5cb2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_pwa_launcher.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 28.3MB
        • SHA256 bc6c5d07c1161798c2f609920a230109d5875d7920dd0b4898c8b3339cff44a2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevated_tracing_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 30.1MB
        • SHA256 f93320a837c50a8de56ad64e490aa27ababb767feb9fec7edc6262ef5179f746
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 28.9MB
        • SHA256 c6760e5f777c719dcf2eca33fdcb4dfb251236a6acafd98162c646f57f363e46
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notification_helper.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 28.3MB
        • SHA256 2a693473b763f0ea3676390a07cebe0c69af7e3f614a6a528bd75f779131ed1b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        os_update_handler.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 28.5MB
        • SHA256 6faf2ae0de98bdb16b09d6e38582d2fa79c7af47b5557b85e429ab7fc394e2e4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 29.7MB
        • SHA256 14fc118a919386624f8e8488294d912d5f01be8225e98a6104b61ebbe181de41
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_proxy.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 28.0MB
        • SHA256 4dd21baaa2fd97d2db30a2a27fbed6f099b6fe975020dd4271790325bda3bf39
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 26.6MB
        • SHA256 46a13cbc948d1f882b1fa3d07a6250deb73d81a09bd25ee94e44e0753ac8fb19
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 26.6MB
        • SHA256 13a64824439252b1bd7bdc8e7ad05202e8fa7bd7e6df1a6c79b4bd05ae42ff72
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 26.6MB
        • SHA256 75145b36bd3f3040772c92d6ef28999a521ed7455419d19b191a37b491001c40
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 26.7MB
        • SHA256 54eec1151f82fdf22bd2ff51e12113ae3507803b2b40ef5181253d1a18d05715
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jar.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 26.6MB
        • SHA256 eb1ef80725d078a839ce03c3eca7bd3529a3797453b33405d0293c87a91d67a9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jarsigner.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        • Size 26.6MB
        • SHA256 b5c2a14f6ffbd278178544e6c69f67bc2d644faedd34ca7ac6213e08fff48af0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 26.6MB
        • SHA256 2912c35b43f062e40663040b85f5cb0be8b89661dc54ce99df19ff78b44423d7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
        • Size 26.9MB
        • SHA256 c1c9533dd16f5d65a249d3a73168e1eee876c7505f35200823b53f9766c9be77
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javac.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
        • Size 26.6MB
        • SHA256 ff2ff6354a618a24af1c151a3e0528950510c3c008e15e2a20763b520cd0e95b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javadoc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
        • Size 26.6MB
        • SHA256 8e6dff0408617f8fed9aa54e50287e7ec3f64a8be8e54bd0b81b33f0e68586fe
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javafxpackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
        • Size 26.8MB
        • SHA256 4563a55ab6ab10b157d29dfd2d995498434300d74ec9ce669f1b7b8c887f5e31
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javah.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
        • Size 26.6MB
        • SHA256 6f35c4f32df9e2e5d3db244297e4c0765b3d408c346a3b3e70d2e6630fa7196a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
        • Size 26.6MB
        • SHA256 d59d2daa55ed22b64b5224729c0e32dc76477643ee3ec6baaa9c9b7e767c634e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javapackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
        • Size 26.8MB
        • SHA256 72a36ba7eee339c61a712e91c35002f0e9b71b68064918aeaac75f34c6733948
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaw.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
        • Size 26.9MB
        • SHA256 5d921a15261e658895e68fc3fab0304eab38e44682ba9856a83177725378a4ea
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
        • Size 27.1MB
        • SHA256 2d5b19a9a69a4d81064a6e196f019c24202c9a3e66e7fcbdcf42b25631dcc769
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jcmd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
        • Size 26.6MB
        • SHA256 3498b58c3d2d9fbf304bc2653137485f71e44f9e3547514142a9edf2a52c8a01
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jconsole.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
        • Size 26.6MB
        • SHA256 594205b1444b8427592f8c1d97551efce12dcda347048920e78aaceb821709c7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdb.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
        • Size 26.6MB
        • SHA256 948fc5d9a69a2a0b4fd2ca1af5eaf7737daa8f1ee4b2e1d21522e00a5e322887
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdeps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
        • Size 26.6MB
        • SHA256 36773e6b58515dc25df2e8702c9e1582b645164afe14fd90139c468951b14a1a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jhat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
        • Size 26.6MB
        • SHA256 600e35453f8bcee70c426d9e6c5360cc66a6d0b076b0ffcb0d335a67c443390b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jinfo.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
        • Size 26.6MB
        • SHA256 c71ee3b0c88a063d35618b2eb3aa37762f6600d9d7e9a7ba493c85bea3682601
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jjs.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
        • Size 26.6MB
        • SHA256 9cdf309a753bc303c816ed9e802b082559d2556452f42386e715fb8681993db7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jmap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
        • Size 26.6MB
        • SHA256 8bfd35230aadf6fb7402c389fe730f53eaae225b0802fd6fa29d1fcea828fbea
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
        • Size 26.6MB
        • SHA256 28d669e3d4e89c0643eac22342f73ba9334d031424e635e0475eff0c952fa7a2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jrunscript.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
        • Size 26.6MB
        • SHA256 6dccd119f5cd1bc5fd519f73b6f2452659585d6ffecd5cc3e07903e6194fc477
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jsadebugd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
        • Size 26.6MB
        • SHA256 a2f3de61663dc5a16f13fe02b3603aa8f5de1903c70de38264e99169e173bc33
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstack.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
        • Size 26.6MB
        • SHA256 a0c4b3488b10922b5238df2a90f99f6f2df6e8b7c82898a5349e6d8f934dac29
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
        • Size 26.6MB
        • SHA256 cb2837ceeb3ea3a699315df68e7d3af4774b98bf76eefe293c6eb9733bd8fdc8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstatd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
        • Size 26.6MB
        • SHA256 81176dfb43567077b8daed014b287a70ecedf9c17bab2c043d978e7c77b035a4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        keytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
        • Size 26.6MB
        • SHA256 0188ac3814d2d32247aa44f1eebc1e17048b9d0eb07dad2c67d2a7329ee032da
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        kinit.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
        • Size 26.6MB
        • SHA256 533b050ef3d56ba5770ffe5e615a64e53e551d68cb888eb948d5430d21c41b1e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        klist.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
        • Size 26.6MB
        • SHA256 cad48f28f1c58508023713288d98baf9093b2912cdbb7ec871e7b25cfb9b20e0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ktab.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
        • Size 26.6MB
        • SHA256 0406c4ee5fdccaf2382c9eb2cf8362f274fdd0b2ff7455d8f246118d8c060f31
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        native2ascii.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
        • Size 26.6MB
        • SHA256 906f309874317ca27db885eba7413d105961e0a45d5cdf8dfaf62f45d61c896d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        orbd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
        • Size 26.6MB
        • SHA256 f961109fa82e2134ea1cdc35f8194547885c77b019d9dc9af876b2327501bf4a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
        • Size 26.6MB
        • SHA256 567fc2bcd058c07b11f4249a788dec535009dfc3bb45ce28f07df85f9fa39926
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        policytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
        • Size 26.6MB
        • SHA256 711426f3ba6b4a08bdb82b2242beb9cfa735008c71d8d489ed24ca60384c04a1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmic.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
        • Size 26.6MB
        • SHA256 6a84dd1056b6ee92754b5d8c96af74e422e52e4e98df3b2cad81acccb5a4a97f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dotnet.exe
        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 26.8MB
        • SHA256 0471fcae92e382a0652216c80a8ae18a5f30ba778f5903d9cec9f2a4006e531f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 26.7MB
        • SHA256 9627916ac639b3c4e2171f91c29217f1d8d7c079a9c8ab13a8c778bde21bce5f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 26.7MB
        • SHA256 aee7e47a846a53bd211c0aabba0257b4903f92f82969f1d8d845cacaf53c8a7d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download