Overview

overview

8

Static

static

3

2026-07-20...ar.exe

windows10-2004-x64

8

2026-07-20...ar.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    151s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260710-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    20/07/2026, 19:37

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-07-20_3676241ee7e3906d6fa6db720c3365ad_cobalt-strike_elex_emotet_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe
  • Size 32.1MB
  • Sample260720-yb4saaez5w
  • SHA256 485810ed8a6640fa205b4c5877da95172245c9a40f077f0f1e17eb3720a63154
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
defense_evasiondiscoverypersistenceransomware

Malware Config

Signatures

  • Drops file in Drivers directory 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Sets desktop wallpaper using registry 2 TTPs 1 IoCs
    ransomware
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies Control Panel 2 IoCs
    defense_evasion
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-07-20_3676241ee7e3906d6fa6db720c3365ad_cobalt-strike_elex_emotet_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-07-20_3676241ee7e3906d6fa6db720c3365ad_cobalt-strike_elex_emotet_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:1576
  • C:\Users\Admin\AppData\Local\Temp\2026-07-20_3676241ee7e3906d6fa6db720c3365ad_cobalt-strike_elex_emotet_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe
    C:\Users\Admin\AppData\Local\Temp/2026-07-20_3676241ee7e3906d6fa6db720c3365ad_cobalt-strike_elex_emotet_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:4588

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        AppVShNotify.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
        • Size 32.1MB
        • SHA256 485810ed8a6640fa205b4c5877da95172245c9a40f077f0f1e17eb3720a63154
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        InspectorOfficeGadget.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
        • Size 32.1MB
        • SHA256 49a3a3684109082d85bad5681c82560dffcb1bf5c2d84c75f1bd033d4cb136eb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        IntegratedOffice.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
        • Size 68.2MB
        • SHA256 01abd1a40bfdc760b284caf672cc3032f7a2bbfad9b9a40a724c1a01b29f1b79
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MavInject32.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
        • Size 64.5MB
        • SHA256 66e738fd8758d3dc1229a4d9dad7a666c4f0546993395b3308b90247073ade66
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appvcleaner.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
        • Size 34.2MB
        • SHA256 0a206cd5e1597e465fa5193eecf2b5b07da2971a49b50fa67209fab8239f64cf
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VSTOInstaller.exe
        • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
        • Size 64.2MB
        • SHA256 a20edf9cafa3cfff3b5c18da01f2e7b9f89603ab52a3ce7dd98bd387c675a545
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrmstp.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        • Size 70.2MB
        • SHA256 a84ea53078ef0422686a0b6c110d6996191bf81095a7d3249b8aa75fee32f11f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_pwa_launcher.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 65.8MB
        • SHA256 c5a8b395bc2f2794e38eb22527c0e4094a6d9a644525f451cde57d5ea8e56075
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevated_tracing_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 67.6MB
        • SHA256 ca31c7c383ab51fd7ee5cd2ca6af6b7f7041546c9d37c9335edb11215037e268
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 66.4MB
        • SHA256 f116be6ea03f68379d7e9ac2c57f045ab99120abf8938066451937ea0622443f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 67.2MB
        • SHA256 cd0bcc5768e96b7870526bedac4fdfa64ecefabd83ba6490041cd14af302c186
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_proxy.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 65.5MB
        • SHA256 45907597d6a76a6d95989a8bf3e7e4bb6d38502425fd1fa34b3bb75f1116e42a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 64.1MB
        • SHA256 7d586f01190bb86c4ec9fd121d83a06a28221d21930ea1457b91b0d15280b1e0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jar.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 64.1MB
        • SHA256 d622b75f5aa1fd52b4c62d297d328d237ae8ee75723a11824f8d477b32e3af45
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jarsigner.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        • Size 64.1MB
        • SHA256 7279200ae33af52aa91a8796c89b1c95e2f99f4b336b1bf91f77a7292625d048
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javadoc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
        • Size 64.1MB
        • SHA256 de663aba57d127d26adf71ae421bc7fb25e7f88cf45fc4fc6907dbfea0aa3fa0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javah.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
        • Size 64.1MB
        • SHA256 1a9d5484b09da9fd610662aa1ec01e6ba46fb3dc39130a315ab8a13cf874b897
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
        • Size 64.1MB
        • SHA256 b66fe1af39d76cfb6da0b2fbaf40b734af5a6567201045f2d18451f1a6c00310
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javapackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
        • Size 64.3MB
        • SHA256 52d66fdc4b6fb1ea4c25ccf9a32ae39ebd19d39f7c81c3b58afee79b1a8f32d1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaw.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
        • Size 64.4MB
        • SHA256 76906ce117cfa812c824f72f27b58f72de114d1c16316179b26fc901d0f71102
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
        • Size 64.6MB
        • SHA256 55303761ddbcdb4a9d06bab8a4b4503a73e4d1687eb51c9c9ecdad5bbbc869d6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jconsole.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
        • Size 64.1MB
        • SHA256 29b9c520514888bcf241ea7183f9943b5c6cbaaa452ca90d3ca60a5d2bfd0667
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdeps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
        • Size 64.1MB
        • SHA256 c946e418a8626c4d1cf3cb688fba0e64e3d469e1116a252e1f0822e0c530670f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jhat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
        • Size 64.1MB
        • SHA256 d551cfc55a5e6edc0f8714a6747bd817434d2d3217ee59a7c780b4b331987275
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jjs.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
        • Size 64.1MB
        • SHA256 1a3452a1cea0494b2d6ad48bafec8dfd2231ef59d80863b8c6eb0c8c1a30dcb6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jmap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
        • Size 64.1MB
        • SHA256 7750e05c9f1fd67d83102c055f9e56fce35d50853c7b65e9d67dd167da34119e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        servertool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
        • Size 64.1MB
        • SHA256 1dcb4622daa784358187ff60836131f1b9d13fee6a219fde1fa035454885a054
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        tnameserv.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
        • Size 64.1MB
        • SHA256 7988d2c81c3352e239db61fb9c608e34357d719d3f46216967db8208b1dae6d6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dotnet.exe
        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 64.3MB
        • SHA256 0867cd07c266307c6714b83c2c0de9c56aba7397943c481147356bdfc2b56b5b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 64.2MB
        • SHA256 805b9557dc8def8b39e534ba050106392881fcb9a04931b117f8988790b5e271
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 64.2MB
        • SHA256 ab6f3fcac362817d9c5880134a2d41e5543766d3ad354c6fc51d399b06312250
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 64.2MB
        • SHA256 e0d4465c16aad628ef30ec189b79e194571b738010589268a44e787c9784f569
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download