Overview

overview

8

Static

static

3

2026-07-20...ar.exe

windows10-2004-x64

8

2026-07-20...ar.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    149s
  • max time network
    127s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    20/07/2026, 10:21

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-07-20_22fa1c516d009d6b65c9f8e780aeee04_cobalt-strike_elex_emotet_glassworm_icedid_remcos_vidar.exe
  • Size 6.1MB
  • Sample260720-mdxwzag191
  • SHA256 6f79cf7e0607fea7214f498a198c3b842e98312e7babada0e9c6cdc6a4619530
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
defense_evasiondiscoverypersistenceransomware

Malware Config

Signatures

  • Drops file in Drivers directory 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Sets desktop wallpaper using registry 2 TTPs 2 IoCs
    ransomware
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies Control Panel 4 IoCs
    defense_evasion
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-07-20_22fa1c516d009d6b65c9f8e780aeee04_cobalt-strike_elex_emotet_glassworm_icedid_remcos_vidar.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-07-20_22fa1c516d009d6b65c9f8e780aeee04_cobalt-strike_elex_emotet_glassworm_icedid_remcos_vidar.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:5272
  • C:\Users\Admin\AppData\Local\Temp\2026-07-20_22fa1c516d009d6b65c9f8e780aeee04_cobalt-strike_elex_emotet_glassworm_icedid_remcos_vidar.exe
    C:\Users\Admin\AppData\Local\Temp/2026-07-20_22fa1c516d009d6b65c9f8e780aeee04_cobalt-strike_elex_emotet_glassworm_icedid_remcos_vidar.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:3524

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        7zFM.exe
        • Path C:\Program Files\7-Zip\7zFM.exe
        • Size 7.0MB
        • SHA256 dd5013c4293dea4e4722ec87742ab8ff98f4620c3e5a84f27437c6ee9a84eafe
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        7zG.exe
        • Path C:\Program Files\7-Zip\7zG.exe
        • Size 6.7MB
        • SHA256 723b63a932ffb36c1b696d504b56be05d8a904d7a822de472c1ef419d0105008
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        InspectorOfficeGadget.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
        • Size 6.1MB
        • SHA256 80e613f77f52b4a342d3d9b85170bb6e75cf426c48f63b617a523cf2afa86296
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        IntegratedOffice.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
        • Size 16.2MB
        • SHA256 d3fc1e3b91de43261762e2ace32a3a0a48abb26b2e9e55dc932b9c70f07bd5f6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MavInject32.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
        • Size 12.5MB
        • SHA256 d299c6c3e0f497723bf46df72b92527c1f8f3df1dfb38cf5cf7dc2d3522282ee
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appvcleaner.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
        • Size 14.2MB
        • SHA256 5a1db807c70cde7317051acc264774ee688c34dc169255d2059c56e78242d1fc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VSTOInstaller.exe
        • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
        • Size 12.2MB
        • SHA256 48e04ce5bd0d59205fe93ff97d3fc1add166346bc79297786dc75a5afd2d8415
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrmstp.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        • Size 18.2MB
        • SHA256 131fdb7175f92d1d604e79057f96e65ca1c682017cddedd10a14f29d23dafc27
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_pwa_launcher.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 13.8MB
        • SHA256 d9f87e84889da40b7e8a31031625cc1a26b69e5c1d22144e734c410c9c480ba6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevated_tracing_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 15.6MB
        • SHA256 c986bdd48cbefcd607248717a2fef52bf1e22ab19e4a4989957338a6adc1bd3a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 14.4MB
        • SHA256 b49fc77635cf2b54f14674f9325eddbff7f50b98f8535fd92da737e2f954a68d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        os_update_handler.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 14.0MB
        • SHA256 c08b2745ac7b5e108330094e926da8eb0ea34893c7e4f016aa12a469d95e4b47
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 15.2MB
        • SHA256 425f1948db2bb9f05dfe724bbc7aaeab560652e8d936656c33f9e0973c7da0a4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_proxy.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 13.5MB
        • SHA256 38c23beba55dff4e92ada81c55d66c4fb267e9bd54a3304eae144c5b523c2468
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        InitializeAssert.exe
        • Path C:\Program Files\InitializeAssert.exe
        • Size 12.3MB
        • SHA256 18a5dac4716af1de9ca8cdfd0692f2bfdce26d8cbed43366005d88b47abb2640
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 12.1MB
        • SHA256 be6849d4e319d1b485506a56e3b0671e46efc75a40e6fd5b4a3c9c1fbf5526cc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 12.1MB
        • SHA256 77334d7756b41c73b9deb23340948c442378f347569e3b651e88beb19818c907
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 12.1MB
        • SHA256 1b16a318b15debdd5d68aa425dc4c0517b15e38030ef49f32ee63c3499ff1f6e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 12.2MB
        • SHA256 44bfc19362b902237fe5f2b9e9eea41f4a4b86f907e8097f4ef9bd5d5beb0194
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jar.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 12.1MB
        • SHA256 e23172daa5193a82c0e1506384cc4bdbaadd7698fe0498febcf38e7298e74f2f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jarsigner.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        • Size 12.1MB
        • SHA256 55a7e48c727795bed9757829933ae110212568f0b4f85a91a1a8ca9a903538aa
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 12.1MB
        • SHA256 fd2a3e9298f88083ae190ead539aadd272d45afc517ee04799f979159fed07a9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
        • Size 12.4MB
        • SHA256 838a3ebbb0b9a79b32849bab8a1b58b9d20843eb67361673c4cc693e4d77118f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javac.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
        • Size 12.1MB
        • SHA256 93525a030f9b7d4a2cc60f0b5e6ceed9dd8dee3cf826db82cf0acde6d613a5be
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javadoc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
        • Size 12.1MB
        • SHA256 cab7cf11e4fe173e8497fd32836d1359c4355714869e57b24667ebf1a6c7442f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javafxpackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
        • Size 12.3MB
        • SHA256 f003c903535f82c8ba918df547101abbc23544bfa8aaa17c890cd71954e7a7c5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javah.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
        • Size 12.1MB
        • SHA256 5b7dda05dc7fd88747dc42ca72a0e0bba92ba8d85eec964347bde25a647c78f8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
        • Size 12.1MB
        • SHA256 ba8070d4f5af195b01e2fb26571268c954aaa5f2ff0b62003f1226814da3eae7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javapackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
        • Size 12.3MB
        • SHA256 6abb403a00e9eaca9a4d6c5110659bce030e02196473fb3779d39b9f7ce5493b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaw.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
        • Size 12.4MB
        • SHA256 fc38ced34960b09edc10baf80be44d6e437e83c84850de675e00479525e8cdb6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
        • Size 12.6MB
        • SHA256 b1952bf1d2b9eed7afd5790e2d35e0d1773afa74d1fe79e89380c65a9ad247bc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jcmd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
        • Size 12.1MB
        • SHA256 6709ec86f9d0058b945089aab345a3ce39341e3deca395e2f0622a64c44fe21e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jconsole.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
        • Size 12.1MB
        • SHA256 7e6c4d7602b03e85f4772160739fd5d116fadc2d385e6d71b37e6d72d7570c60
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdb.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
        • Size 12.1MB
        • SHA256 5abb1f20800310ec18874f174441e1efbd493d753bd51aa50839a0ea8ede0814
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdeps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
        • Size 12.1MB
        • SHA256 dfdcb37d5ca999e6512fa4bc7f12e10b0c6f1edcd52ebc122a5f35998fa3c564
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jhat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
        • Size 12.1MB
        • SHA256 3a7404fa69e86d5f1011260eed269314f39a1577b2b161c4e11388d6b277901e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jinfo.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
        • Size 12.1MB
        • SHA256 96c2840a58700d1cb6ff5d580a5dafe79330c3b1af5dd27a7b96d797aea2ce10
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jjs.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
        • Size 12.1MB
        • SHA256 a10d05c6a0f0c69413e6790f348b323be7074901f9344a6b103fa05ec6e03970
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jmap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
        • Size 12.1MB
        • SHA256 8d83827fe521926de8f66305da18c18f656154b70c71d4a5cb95160adf74a8b8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jrunscript.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
        • Size 12.1MB
        • SHA256 ae0df6fe264f819fcebd0c407784ba4ef48e97f25452a0408ae50624df337d4e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jsadebugd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
        • Size 12.1MB
        • SHA256 4753d4da706f172ac231dc49567454da924818aa2476b7b3e3cc17a914bdc97b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstack.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
        • Size 12.1MB
        • SHA256 7307a22a5312a7e946ba31a6b6ec883126a9034f2b7132415629ae2339438165
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
        • Size 12.1MB
        • SHA256 a055001edb0a529f91e878719be227f0dd9008eaafbc6969b6a5bbe8384e0861
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstatd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
        • Size 12.1MB
        • SHA256 901ef6a435bf1b08e8de3a635d27b456fd3854fd1cb7dd01322992583e93398a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        keytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
        • Size 12.1MB
        • SHA256 9a2fff5b791b4a0901a08975a4274af47eb4be6a441330ff89b2db06a44fae91
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        kinit.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
        • Size 12.1MB
        • SHA256 112c253789acac095a381a6d0dd8e65cb10c0ad27c11eed79afebbeeb77629b2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        klist.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
        • Size 12.1MB
        • SHA256 484c625b308aeef52143e853af44c6f502c6cb3dd916299eecda4b4d24f91ddf
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ktab.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
        • Size 12.1MB
        • SHA256 5545c2855b9365e48de203ea0afcaa880e767c24a77719a3932e5440c12f41b0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        native2ascii.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
        • Size 12.1MB
        • SHA256 4c527b034faa97cf90b19d7ec79b2f7ee3b181992ad1cc1c99e0811007b7de3e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        orbd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
        • Size 12.1MB
        • SHA256 4bc354e695589ae24103c91753e651a0ee1d2d271823c98134ffe8fbfe05f9e7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
        • Size 12.1MB
        • SHA256 fb95763643262b0a143f80e1225cb5cde26722a9684addc8589dd93c2a76a630
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        policytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
        • Size 12.1MB
        • SHA256 18a8dd183ecb2297497b7d509d970aba4503af2b9ef15b5b1c78de72abf7d868
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmic.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
        • Size 12.1MB
        • SHA256 4f52a1d8cc0b22e7b5bfa9b124179b50e648f6fda113e6934b5afe75cd6568eb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmid.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
        • Size 12.1MB
        • SHA256 aae8f7495089e755e13e16f9f68fac9863845a6913611fe0835468e4c0faedd3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmiregistry.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
        • Size 12.1MB
        • SHA256 14ee66519161993f702271e9c8730712bc1172dc520361bfae3b139bee7d3209
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dotnet.exe
        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 12.3MB
        • SHA256 f33b1ad97c53def48fc460818b9c8d379c02dc2031001b1158a052eaaeed6fa7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 12.2MB
        • SHA256 0d81dea6c92dc8c125f83dfe74259d54d0cccb5b966a7e9d05d6f57fe5c4e21d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 12.2MB
        • SHA256 d7075ea9df27b69afbe7fb5aa19fce883c36c5e4a0af98969a6a0a2a8cb44e81
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 12.2MB
        • SHA256 ce59d6fbaa40368403cac156c5d3554a9bfb40be5426495331daf8bd8f95acee
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download