Overview

overview

8

Static

static

3

2026-07-27...ar.exe

windows10-2004-x64

8

2026-07-27...ar.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    65s
  • max time network
    137s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260513-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    27/07/2026, 14:23

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-07-27_9edf5d51ac6150c1b90f50295cd39fee_cobalt-strike_elex_emotet_glassworm_icedid_njrat_remcos_vidar.exe
  • Size 17.2MB
  • Sample260727-rp4acavbme
  • SHA256 6f343e90b1961dc334631de6e32c55c930d349387d633ff27724851d328a72e7
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
defense_evasiondiscoverypersistenceransomware

Malware Config

Signatures

  • Drops file in Drivers directory 3 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Sets desktop wallpaper using registry 2 TTPs 1 IoCs
    ransomware
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies Control Panel 2 IoCs
    defense_evasion
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-07-27_9edf5d51ac6150c1b90f50295cd39fee_cobalt-strike_elex_emotet_glassworm_icedid_njrat_remcos_vidar.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-07-27_9edf5d51ac6150c1b90f50295cd39fee_cobalt-strike_elex_emotet_glassworm_icedid_njrat_remcos_vidar.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:3284
  • C:\Users\Admin\AppData\Local\Temp\2026-07-27_9edf5d51ac6150c1b90f50295cd39fee_cobalt-strike_elex_emotet_glassworm_icedid_njrat_remcos_vidar.exe
    C:\Users\Admin\AppData\Local\Temp/2026-07-27_9edf5d51ac6150c1b90f50295cd39fee_cobalt-strike_elex_emotet_glassworm_icedid_njrat_remcos_vidar.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:2128

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        7z.exe
        • Path C:\Program Files\7-Zip\7z.exe
        • Size 18.7MB
        • SHA256 20da025b24ed73dcb4b0781b4d218c813f4e34ecd056afcc515de932dc15e89f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        7zFM.exe
        • Path C:\Program Files\7-Zip\7zFM.exe
        • Size 18.2MB
        • SHA256 2a171007419fc38c2bd76781b6dfc8eef3d346cdf839e0d80f45c626e5a32896
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        7zG.exe
        • Path C:\Program Files\7-Zip\7zG.exe
        • Size 18.2MB
        • SHA256 99f1e50cfa87f341320c67807c1a3c1efe1bd898ff5b7e31f52042b70548957d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        7zG.exe
        • Path C:\Program Files\7-Zip\7zG.exe
        • Size 21.7MB
        • SHA256 33dbf44a430015df4cb1430cb96db5dff3cc102ff3ea1f23b032e90d9624f5b1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Uninstall.exe
        • Path C:\Program Files\7-Zip\Uninstall.exe
        • Size 17.9MB
        • SHA256 aeef04f78e1cb8e900c977548b2dc3945bc3c75769b7bc8376533cc944eaf690
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        AppVShNotify.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
        • Size 16.9MB
        • SHA256 985cae29fe4977155b4df0191da80d045d66eac7793947cecba61b55eed61cb1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        InspectorOfficeGadget.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
        • Size 15.8MB
        • SHA256 ce755e8b3be94829318a9e0c8c4e2ef8347239f0ba4e80b8da561cef421a1ddf
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        IntegratedOffice.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
        • Size 17.6MB
        • SHA256 603471cd6f9f497d13f6f32379cc4a625054c8dd36b0cab0f9fc692b1a322528
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MavInject32.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
        • Size 17.1MB
        • SHA256 e7a8fedad5d9b64ca672fc5ecbb2379a2bf0208783d5f1fc3d42b5a5683ed6c5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        OfficeC2RClient.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
        • Size 15.6MB
        • SHA256 a614873639caeab1d3b81c22bad621d60cc6dc139e5444d9ae572c4769acd27f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appvcleaner.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
        • Size 16.4MB
        • SHA256 d2f2d557120c329f25f7ec7d6f3d66d38d9ee1cef81022b0a58c23df6b30d577
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VSTOInstaller.exe
        • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
        • Size 15.4MB
        • SHA256 d80da0772a6a996f1b137ec4b566418d31cb00ebe6c4657e969923821c07122a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrmstp.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        • Size 15.3MB
        • SHA256 4562eafbb84b35e5bd122a8dfc1d46b5ae476c357c77906fcdcd20e2c6d5a8c5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        setup.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
        • Size 13.8MB
        • SHA256 ba6b7382d6e4e8d7e0e4998acf50f74fdf2b991063eb71e35dd1479bc9984d9e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_pwa_launcher.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 15.0MB
        • SHA256 c5739a76d4cc149f2438df004a8c2e5dd67fa8f4c43010d97c8112451588512b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevated_tracing_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 14.7MB
        • SHA256 2edd8122c15756c132d2b1984ab152ddffe7d6eb672274dc7bab37153bfc4b4c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 14.2MB
        • SHA256 67cb14bebdfe80b2cc38b2525d8ca8d98ccf40b5fbbee2f9f800bf45c4ce0d0a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notification_helper.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 14.4MB
        • SHA256 15f6277f5f49c39e726d7ea19e764f465015b5669b9063901718eac491205e3d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        os_update_handler.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 13.8MB
        • SHA256 8fd4d383c5df307e0370b9fc296c93024e01c7b37c03eee7ba02aca3624818ac
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 12.6MB
        • SHA256 f98da73f4ba80606a870588d1dd1c0720b230e0dea1e466e4aa278d5af0940d4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_proxy.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 13.4MB
        • SHA256 ed97798f70754cb5f85376b432515058b864d6fe909d87b7309f8fdc491e1074
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 12.9MB
        • SHA256 f6e2d6fd5dd0e1d2813d2f065175c59002f04644d5701ccbc46aba594c068c58
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 12.4MB
        • SHA256 4bcd47a90a64ff211866988e8e1d8573a7bc8c5c5173e6c7cc4374e43cc94eef
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 14.0MB
        • SHA256 e4ecc4dc35b44ce26e19efcb35b6f32e385b99a4602a8aa9f17cc961e96b83bc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 128KB
        • SHA256 e52488a8a3c5c15a2f928eb2127c84d20ca0143b2598bd3c627a271a6a7a3d72
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jar.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 11.5MB
        • SHA256 9208ca7287465a9a9d0da0aba01a6a0aad469d7f414d59dd0f63debab9bb38d7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jarsigner.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        • Size 13.2MB
        • SHA256 77de4c6daf5c6cbb430a99dd2ddc5887ba3a06aafb75974b6b9052443f027411
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javac.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
        • Size 12.7MB
        • SHA256 083d4ef07f9c93969a93161c1d6e435bc930892dc2bdbae5672643e7112d7496
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javadoc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
        • Size 12.2MB
        • SHA256 d4ef77f0da48c178292737d15027411331ff6f7f6af3e6c7c17b74a359998d1f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javah.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
        • Size 13.5MB
        • SHA256 d0897c60aac460d57cf25bda71bfe9096a3a6b31bf4ac3e2a32741da81050c84
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
        • Size 12.8MB
        • SHA256 c2b42092c451a630894e56184ae589e48b1b20a8d2865ef0e0a96fee0951c7ec
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javapackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
        • Size 12.0MB
        • SHA256 45c326f97414c57fd1627561d7f39f77f03d14fe47e1a94a019235f66a8b54a4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaw.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
        • Size 12.9MB
        • SHA256 6ae9f8f4a894b5a4f28a7012867d36f3db6f5c6f847c2ef69f940fe70cc14a7e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jcmd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
        • Size 12.7MB
        • SHA256 d9845e5b498435885e4868c2454587eac1a1c46963792fb52e3f2d1671c5784e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jconsole.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
        • Size 12.4MB
        • SHA256 6af9fe4a31681aba91eab3de761d7f4955b31d6557b57a3e2249113803e450f4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdb.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
        • Size 13.3MB
        • SHA256 372073dab2c747a9d242b0f9e05449756ddf814f39b0198b7c9e99f73cb9057c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdeps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
        • Size 13.6MB
        • SHA256 09e779ff09b3052807f0f23be362b84fa546b7886ae514eaa4a37e878b4e74a6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jinfo.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
        • Size 13.6MB
        • SHA256 3d4cc5f19b4909429b5f558475a1ff345dc385be72e99e9c75caa3156adc92d9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jjs.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
        • Size 13.3MB
        • SHA256 6c5a2c02d641ca71e449b7cef979f0c4d830cc28978de312c280eb3b1f99945a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jmap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
        • Size 13.3MB
        • SHA256 f8e982814c46ac7df9e7c50c200182f9117bd7facc43219692fb56c4d5bada95
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
        • Size 12.8MB
        • SHA256 214e2d78e4d6fbc6e90b0120e8cf6706a59f5fc6bac2d448b5f5f2f3494c4621
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstack.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
        • Size 11.8MB
        • SHA256 a97301b58847142c31d6efee5ef36fd678331a3258d66c9a1d1f8266636fe71b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
        • Size 12.9MB
        • SHA256 41c04c52e33e4ae780fed16cdcfae64498f124e794e7b5c2f87a7b8840926848
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstatd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
        • Size 13.2MB
        • SHA256 16e492871cf24919e9bc5dd9bcdc96b868e827eb5d9679dbd8721f37d818ed7f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        keytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
        • Size 12.9MB
        • SHA256 05f4e4525ac8b90215e0766d7a0bd8ee9f7713f303c12ffad21d0ca134586fe6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        kinit.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
        • Size 12.5MB
        • SHA256 6367598de0b1980b533c089cc6355795e1947a4c920c323dde4ab47ad1eb9ad4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ktab.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
        • Size 13.2MB
        • SHA256 38482cd3c151caa093d0c5671141b8b20309dba0b0eb8d8b366b88e5db01681d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        native2ascii.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
        • Size 11.3MB
        • SHA256 028f1b990d4b831d749f27add8cf54490aae82333393cff98a294e7ed0d0df39
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        orbd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
        • Size 12.1MB
        • SHA256 cd941333041f371a64e6e34c283e3ff516eb0e243efe3cb179fc2f5955e6eee2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
        • Size 12.7MB
        • SHA256 4993c1c1e42239e8fb746759204c3f634caa6c59297dba449b0c22f8dbcef717
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        policytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
        • Size 12.6MB
        • SHA256 e9c75c6922abd916ca30a21b6c5f357ae42ec8735085415b48676d8a08c3d858
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmic.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
        • Size 12.5MB
        • SHA256 26cdb1f07b1692525046df8abbb44217905feee61cd096d2aef589e422816f2f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 16.7MB
        • SHA256 39519ab1c6299a88b03a9afc71e8818af251c0a412ca18caca00849c237e94eb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 13.9MB
        • SHA256 04abe9228017b7c4556f94822a639d234527c6f3a2e7ff47d814fb1c54fda8fe
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 15.1MB
        • SHA256 e90a48d5e0e5d88fff883c7f4fef7a500e9fdc23e9c21024b0e99cecadb3a608
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        spo0lve.exe
        • Path C:\windows\SysWOW64\drivers\spo0lve.exe
        • Size 17.2MB
        • SHA256 6f343e90b1961dc334631de6e32c55c930d349387d633ff27724851d328a72e7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download