Overview

overview

8

Static

static

3

2026-07-20...ar.exe

windows10-2004-x64

8

2026-07-20...ar.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    150s
  • max time network
    151s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    20/07/2026, 09:52

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-07-20_57ab04d6c24b962b653b1bf48a4bd12c_cobalt-strike_elex_emotet_glassworm_icedid_remcos_vidar.exe
  • Size 6.1MB
  • Sample260720-lv6prsdy2k
  • SHA256 58e0b87466c6df4be66a78e9a92f79e34d37a12a3998ea08e1afa390715f3d1e
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
defense_evasiondiscoverypersistenceransomware

Malware Config

Signatures

  • Drops file in Drivers directory 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Sets desktop wallpaper using registry 2 TTPs 2 IoCs
    ransomware
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies Control Panel 4 IoCs
    defense_evasion
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-07-20_57ab04d6c24b962b653b1bf48a4bd12c_cobalt-strike_elex_emotet_glassworm_icedid_remcos_vidar.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-07-20_57ab04d6c24b962b653b1bf48a4bd12c_cobalt-strike_elex_emotet_glassworm_icedid_remcos_vidar.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:4024
  • C:\Users\Admin\AppData\Local\Temp\2026-07-20_57ab04d6c24b962b653b1bf48a4bd12c_cobalt-strike_elex_emotet_glassworm_icedid_remcos_vidar.exe
    C:\Users\Admin\AppData\Local\Temp/2026-07-20_57ab04d6c24b962b653b1bf48a4bd12c_cobalt-strike_elex_emotet_glassworm_icedid_remcos_vidar.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:3012

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        7zFM.exe
        • Path C:\Program Files\7-Zip\7zFM.exe
        • Size 7.1MB
        • SHA256 f46de987fca8dc2e256ac353a9ed0c6c938453f360cde5e649cf9873ec6a8984
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        7zG.exe
        • Path C:\Program Files\7-Zip\7zG.exe
        • Size 12.9MB
        • SHA256 df05cff4d9b9a0db775ff8f0145eaf76d7206f2739a8756501d7c2720c96c755
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Uninstall.exe
        • Path C:\Program Files\7-Zip\Uninstall.exe
        • Size 12.3MB
        • SHA256 2b46e6c7eb4aa1cead205af850485b17f4b375a0567c79d217c4297f32eb8abe
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        AppVShNotify.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
        • Size 12.5MB
        • SHA256 8298027fc102d9da578b7a429a26788f94c53412bd1222aba0fab54399b1b12c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        InspectorOfficeGadget.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
        • Size 12.3MB
        • SHA256 6bb172c5557b0e48771079eddab4b1a8581a04fc09c832668fbf29c8e0696556
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        IntegratedOffice.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
        • Size 16.4MB
        • SHA256 e5a97ac57d045bb298cf3016c3e7441e30dfb4fe8b3b75cf1f661191e7012673
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MavInject32.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
        • Size 12.6MB
        • SHA256 ce78e393855d494b60cad68b41044dd82f361d2b521a5d1ff2c1df9930c57adf
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appvcleaner.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
        • Size 14.4MB
        • SHA256 444c7c4fed5044961a226c3ed2e34aae7e09c957922eeaddbdd79ae054f137f4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VSTOInstaller.exe
        • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
        • Size 6.2MB
        • SHA256 e84e2d70dcbe6cddf589c444c00d04cf05b126120cbcb86011877dd7e5b68789
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        setup.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
        • Size 18.3MB
        • SHA256 07e5f2274c29a30837c7635d0a05398b27c5e3ea22374555d04045ee04899a1b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_pwa_launcher.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 14.0MB
        • SHA256 7dc458ec2bd0ab45cb0be525f0f8b1f19dd2ba3de875d89484a1934c95dfbec0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevated_tracing_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 15.7MB
        • SHA256 4f88eece5033d7c4d70192c44589806112cf55e9e8f3f77cee4bdb322e6b63ad
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 14.5MB
        • SHA256 8d89ce3d9cdf14d0be4fc8b5324b02be5e5f9c2809009df47c38cd8cd6f65d25
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notification_helper.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 13.9MB
        • SHA256 36fa39ead414d3453dc36d234c757a7ab537312fe182a85aef75b97b3fcd2c05
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        os_update_handler.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 14.1MB
        • SHA256 e007c61ed1eee6e70af53929f74e7ca1af1b88c73036cc188bc61d9fb2a77431
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 15.3MB
        • SHA256 dc345f19cd223b8277896bbcb158ee73bbd1d989cf18cab9aee2b283ea0c48e3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_proxy.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 13.7MB
        • SHA256 a8f0d9dd39c95ee8b170f19f0943147dc72fd4fb952700cb2943ac020931df12
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 12.3MB
        • SHA256 a703714f62b7bc9dd87797dedd653f94fe9aaa90e823f2bf4d75b3639ab93698
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 12.3MB
        • SHA256 f6c5fc8e8acf2576663dce8e8a46d2cb08435f9a3db1e27e02089b061937935d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 12.3MB
        • SHA256 9cc03454e0e7a11b4194071ce7df7ee3fdee2ef554f73748ddd2b664f1500839
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 6.2MB
        • SHA256 1b99801530c065e56f17f69ba2b51aac6a0049474d9967fe4dd157bed4e12bc8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jar.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 12.3MB
        • SHA256 468b42e2a472c1874f7abaac7d66cf65b1d689550a01c8eb2820cd9489a05173
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jarsigner.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        • Size 12.3MB
        • SHA256 febbd05ffb66e59ded477d9e18a925e3b445f4da5c56863f35179fd4fe8dfcbc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 12.3MB
        • SHA256 8f74abe8af86919fb549291a030a00a94c33507b4847a0cd51799341cf15cb35
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
        • Size 12.6MB
        • SHA256 15469edc8b475bb4e935d59f2247438ebf36009c71280d2c0ea0befd3b02e8a9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javac.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
        • Size 12.3MB
        • SHA256 0ff624562a83ab141e43a8e34998e61dc75855f9ba5e016586cf858c45b287ba
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javadoc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
        • Size 12.3MB
        • SHA256 6863b182787e15eb777042f8d8b93f5e0cd5e6a491c02cde3026ad62c25cbbd7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javafxpackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
        • Size 6.3MB
        • SHA256 8498ed55c4ff9f430c747509b64350e7a42e906614c60a4287caf17b605eb48e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javah.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
        • Size 12.3MB
        • SHA256 4c392506aaeedae364b2b6a7f66c9a76d3c57832fce500cabbf02f33d6578afa
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
        • Size 12.3MB
        • SHA256 44f03f9604337fce32952d83ee64dbb15dd721b87c7943891a2f05b717f3185e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javapackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
        • Size 12.4MB
        • SHA256 24680b95c48704ebc3310d781a0ab475bb129b030665a0ea2b381c0147b10d76
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaw.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
        • Size 12.6MB
        • SHA256 53d90a31f3dca645d191de2b12bcd6c27f36a1265d71a69a37cfb67543b03fff
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jcmd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
        • Size 12.3MB
        • SHA256 09070da8f332f8b8fe7ff14ef48795413e79e2e56fcf1b1849afb7bb37a3b9b4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jconsole.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
        • Size 12.3MB
        • SHA256 183f7cfb1ae516c226b4276121fbe557be1101040bb9d9da6d2c44a81ca74338
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdb.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
        • Size 12.3MB
        • SHA256 dfc8581a6274bbfea732c8e80a6a1b9f53626b6788bb69f1fd018c136613036c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdeps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
        • Size 12.3MB
        • SHA256 c627388382c30e863ef5919065e3f7a00a56578a0d830eed99e27d99ca849626
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jhat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
        • Size 12.3MB
        • SHA256 7d32e1da1698c130d79581bffbb6f4f85025da778864a898dd3b03ac48818527
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jinfo.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
        • Size 12.3MB
        • SHA256 57051ea94b60d2f723a590163ee46c8f9eaed4857dc83a590515ceb82d55daa7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jjs.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
        • Size 12.3MB
        • SHA256 f16e27fa95eeb45a79f5e159d1e2cb3a59dccf1e0f69fa7158f25ef7f92008f2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jmap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
        • Size 12.3MB
        • SHA256 30d9effbb08a6cab5c97d00178275a73ffb4b3bb56b9434ba75a4c148301af17
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
        • Size 12.3MB
        • SHA256 76eaed4af8e567ace625d5b8724a98f290a72fb18846f0a206284f23dae0306f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jrunscript.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
        • Size 12.3MB
        • SHA256 5a533a55fed1da94d6de3371484943e4e0fc9e63eeb566ba1101fde3bc6fa7ca
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jsadebugd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
        • Size 12.3MB
        • SHA256 ee2d72ade0af46b2c5de802de6f06d0e68be4f4327486c1613b3fcb1aa1d0458
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstack.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
        • Size 12.3MB
        • SHA256 4ad800a2a42d8828a60ade682290e6ee6651fb14ff81e790efe026ef9bf39306
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
        • Size 12.3MB
        • SHA256 72d228aa7ad781f20ec25cf41d68068019bca562c73c44e1ef69c38c611cf532
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstatd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
        • Size 12.3MB
        • SHA256 97e4772bb2f92f8f9bbff2f692b8517982df1ff2a821bc418fe77e53386340e1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        keytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
        • Size 12.3MB
        • SHA256 9af534a7eeb6d83a4c7114b63c10924eec0d8134ff0a35a89c751eceb6f07e64
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        kinit.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
        • Size 12.3MB
        • SHA256 a1939286e73dd31c712f392b1b47e474750f3a901e292156d8db4d4e0ba2b547
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        klist.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
        • Size 12.3MB
        • SHA256 b91195f1c15bebb3f42c025ef573734e94cc26892e8260f5da81463faff53962
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ktab.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
        • Size 12.3MB
        • SHA256 8da9126670012f45199abf9b1085780386eddbd57cedf1e8090c8039ad907970
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        native2ascii.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
        • Size 12.3MB
        • SHA256 ea2526ec62df79286d9e161ab56c993a1fd150785a6cbd8f80a9bc100e230eae
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        orbd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
        • Size 12.3MB
        • SHA256 0b95bf49c49c1b9c7ee6b2b5badb13ae8d6955528de80b30e916920c7dbfa65e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
        • Size 12.3MB
        • SHA256 37ef215601e9b88fede5683bba2f22a5a92c879bcd2f1b445b29cc4e6ad1553b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        policytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
        • Size 12.3MB
        • SHA256 440ea659d193123e1c0d824ae56916075b062ef9783abeb90d6f83d5e98d699d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmic.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
        • Size 12.3MB
        • SHA256 238ea9d10df9068545292703462f138e7b0aec43633512e31c71617799894694
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmid.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
        • Size 12.3MB
        • SHA256 fc9061d2fc1bb34f1fdacbdbbed029732ea89dd5c64e2b9ef554819f6f3cf137
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmiregistry.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
        • Size 12.3MB
        • SHA256 13973d1140de7b48eca58b0a3a5ed88d1b105f478b34f0dada51bed9fd78fa44
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dotnet.exe
        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 12.4MB
        • SHA256 f1162635f9366f8ce07b08f05434c2d03d9afe6f258492105a204b7448acc838
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 12.3MB
        • SHA256 b783bdcde310c071f89fa762756195cd28ef905e030fb9a66c08e2d52da4123e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 12.3MB
        • SHA256 1b3e6ecdc2ae641f33f100a2e6e358f93969093607ad05ffe725faf467d0a543
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 12.3MB
        • SHA256 5f9cc98d1d0955c74983b0e7347ab8d680e53814d6636d6135f6a377e125ba3c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download