Overview

overview

8

Static

static

3

2026-07-30...ar.exe

windows10-2004-x64

8

2026-07-30...ar.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    108s
  • max time network
    130s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260710-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    30/07/2026, 01:23

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-07-30_88fe356f5c97880c2692f0c8871d4fb8_cobalt-strike_elex_emotet_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe
  • Size 40.4MB
  • Sample260730-br7sjszwdv
  • SHA256 35659450e805f9774c13986b77850027aea7de3282b54557dd3197fff220b749
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
defense_evasiondiscoverypersistenceransomware

Malware Config

Signatures

  • Drops file in Drivers directory 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Sets desktop wallpaper using registry 2 TTPs 1 IoCs
    ransomware
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies Control Panel 2 IoCs
    defense_evasion
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-07-30_88fe356f5c97880c2692f0c8871d4fb8_cobalt-strike_elex_emotet_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-07-30_88fe356f5c97880c2692f0c8871d4fb8_cobalt-strike_elex_emotet_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:5076
  • C:\Users\Admin\AppData\Local\Temp\2026-07-30_88fe356f5c97880c2692f0c8871d4fb8_cobalt-strike_elex_emotet_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe
    C:\Users\Admin\AppData\Local\Temp/2026-07-30_88fe356f5c97880c2692f0c8871d4fb8_cobalt-strike_elex_emotet_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:1020

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        7z.exe
        • Path C:\Program Files\7-Zip\7z.exe
        • Size 40.0MB
        • SHA256 97612c346dba93890142822d15290496fe45c16506214614afcc5df294fc6aae
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        7zFM.exe
        • Path C:\Program Files\7-Zip\7zFM.exe
        • Size 37.6MB
        • SHA256 efac06a3be4945936d2f576068a9cd06c58623b87d69174a8e7dcc1cc2385eea
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        7zG.exe
        • Path C:\Program Files\7-Zip\7zG.exe
        • Size 27.4MB
        • SHA256 93f89d3c9f96264912b462c9e04d7c5ec1537c9105067541353fdd85e45cc195
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Uninstall.exe
        • Path C:\Program Files\7-Zip\Uninstall.exe
        • Size 26.9MB
        • SHA256 89b55bfdda4cddf9c461a2129a70daa2c94a0482b0106e68ce1d2e6f068fdedd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Uninstall.exe
        • Path C:\Program Files\7-Zip\Uninstall.exe
        • Size 34.4MB
        • SHA256 b4ca16f9535a67153b8c17b8bb459db20ff35c16129898d6189f70662d503caf
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        AppVShNotify.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
        • Size 24.7MB
        • SHA256 3b012f882194f2312271325dcb934b80ea61a46963904c2b04fde05d59d730ef
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        InspectorOfficeGadget.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
        • Size 24.3MB
        • SHA256 75aae5cc35840188c09108653624e32a09e979169cb8342b4dc30a190cd53a6c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        IntegratedOffice.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
        • Size 22.1MB
        • SHA256 7ba35f2af8d1860e67a1973e50f90609ae9172e2e47c167e407fb285e15d9ca3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MavInject32.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
        • Size 22.9MB
        • SHA256 322076e5c81c9ede4ff4e822137e11d838e3358162c06fe52189e12b0545a512
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VSTOInstaller.exe
        • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
        • Size 21.1MB
        • SHA256 274290d0f20c1f863947be3243820ca0be96db091dfa10544684068cdb2e2c2c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrmstp.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        • Size 19.5MB
        • SHA256 048e14d6a00094d214094fa19c3f1499c274d286fd8ff2cc48e3f74324bddd49
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        setup.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
        • Size 17.9MB
        • SHA256 f45540a676d4ae856ac49652557d3d577afcb52e855ec9c9a18d476d44976e9c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_pwa_launcher.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 18.8MB
        • SHA256 abcd7a67a3d74031f8892bacef92eaa0de74d7c1f03e352c550b0688991bdbf4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevated_tracing_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 16.9MB
        • SHA256 a644245cf3e9d807bbeadbb942bb9d93cf645b0067b93a0ad8f0e378a84115aa
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 17.1MB
        • SHA256 f75baf66a4fbc06f8f7d4f23dfec6a1808f317574e13ebc9ccdea560470f072a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notification_helper.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 16.9MB
        • SHA256 6775be7f41f3a12c0bfe676ff1a9922dbc40169f791593a7d5e62f081d119063
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        os_update_handler.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 15.7MB
        • SHA256 37e1eca6838b1bbe82f10f800846be2b070b2d8d50b5930086f3b7f5e63c242c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 17.9MB
        • SHA256 d1fe95626e2fe385ba02c651cf0fcba4a7bfcf7524f8b2fddf5a2a1410682540
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_proxy.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 17.8MB
        • SHA256 86a2014d4d75d3db304bd8e0d2004a3e59be1abea5e8dc12806ae978125e0ec0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        GrantUnpublish.exe
        • Path C:\Program Files\GrantUnpublish.exe
        • Size 15.7MB
        • SHA256 a4b67d5eebc68f8e05ac2ae905a8257a1f4261b57b35d7f0c15660d637ae9f8e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 15.3MB
        • SHA256 769618ac89cf687097244550ec327509eed57206659daa1d11bcf16ba8a1a305
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 14.6MB
        • SHA256 305284880da5adbf2c7b2d9a50fe115469f6f9db0c67c2905150c3025bd62065
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 16.6MB
        • SHA256 77c96cdf397dda5c01a55ed01cd527e11eb5ae16c71d1b161a0e4e218755f5f1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 17.7MB
        • SHA256 1b50b39baeaddcabab14b0829a9b8c446d01c187cbaf5654d5259196b8f7a64b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jar.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 15.4MB
        • SHA256 0a4fa318405bbd1f269f9f35df15a3528ebf0fe61e5cd260abf7d1612d364bff
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jarsigner.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        • Size 16.4MB
        • SHA256 e1d47eaf69240e355dde112de627d352d7ba8dce74176ae69a1f5aef9686b880
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
        • Size 16.3MB
        • SHA256 91a68f22148f7413e6f008dd5d332fe930dd0dce3c6a85db53151ba60f1f2c50
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javac.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
        • Size 15.9MB
        • SHA256 d516a79546256c8e380bfcc3f8634e6d0602c7603d2774898ed6d311c0705f8d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javadoc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
        • Size 16.0MB
        • SHA256 dd78a3d578119f7910db7c75352ce66e9ea89e4c801c12ec5724d35ee18c094b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javah.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
        • Size 15.0MB
        • SHA256 7d67a137b91a0832182d3fcbdda83aaf2d607a0e05be0b49aa8ecf105be3b1d3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
        • Size 15.8MB
        • SHA256 97bd96523d2862bb3461eb7fa922dddfd85270f2dd281d257b9efda5d5398455
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javapackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
        • Size 15.0MB
        • SHA256 b8915c0de218ebd5f0f7e5ef2d848ce52d9d5dbd0f5908ab46bf67b0e1403fab
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaw.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
        • Size 15.6MB
        • SHA256 12ae454c583436a7274edcc4fc8d6db3089216875b09bce4c2fc10e45e641150
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jcmd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
        • Size 15.0MB
        • SHA256 1ef97cb8f26856f6729f296bc382e3e7f23a9aab8dde75a0e2d12275de541d1f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jconsole.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
        • Size 14.2MB
        • SHA256 e5d8de2e828c13073b5f11cb45f55761ed42e549964eef5679f8485de6e3fd81
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdb.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
        • Size 15.2MB
        • SHA256 e1a959f97e0ac05ed5a214e1c9a26ce0f96439fced58af0b3a768537edbc4785
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdeps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
        • Size 14.9MB
        • SHA256 e91b9d45ea2d8406874c4c7b92a63d9d75254226dc84644a323276f7217a164b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jhat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
        • Size 13.8MB
        • SHA256 ad20c8481970b5715d6827fa7f490a1a68934d37f540569404ee283a7c89669a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jinfo.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
        • Size 16.2MB
        • SHA256 fa5c6323e285f8d5db237abbb6ccb2fe367fb14343f72f03c2cba53b3566374c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jmap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
        • Size 13.9MB
        • SHA256 86b89243a0d782ee14b4770517df0f45179714e9c8029b534b5a9313ad34d2e8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
        • Size 14.8MB
        • SHA256 9ff2410e7142ef993f1cbdccd72d9a0075765470ba5a55635d36501279f1cfd4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jrunscript.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
        • Size 12.8MB
        • SHA256 bce2cc747b01e0bdf0bda43c42dfff20a5a0f65b5f692ddcc21eea07b6040875
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jsadebugd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
        • Size 14.0MB
        • SHA256 70cae577a5882e1342eb001c7cfb53856ff704902908ee965b3191615d20c1c2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstack.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
        • Size 11.9MB
        • SHA256 7018fbe92773c44cf2fff37f4105683f78f0d05b98c4532d15b230d66e48a896
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
        • Size 12.6MB
        • SHA256 aa1964b883f091231ab2f84d43cf759938e128415db2f4fb53e8ac6c05770c5f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstatd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
        • Size 14.1MB
        • SHA256 7e0b1c149bb5d1d69b4f8e34ffc387b2a3a1daec8d5df90f62941d16d437dd43
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        keytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
        • Size 13.6MB
        • SHA256 ed695634e0f80dc0e5e6872f6623282d3d3c022042e3415c0fc6caa66f991f7e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        kinit.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
        • Size 13.4MB
        • SHA256 ce269267a15a8312dd43fc1d27c5f3dee4157fcd489aacc46e27c008ac93f6a4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        klist.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
        • Size 13.6MB
        • SHA256 bedb0e5191e4979d12a0381264bea790e8a86cf6dadf813ceb1cfe2027a2d9e9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ktab.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
        • Size 12.8MB
        • SHA256 8b20a193c190bd39cee8b05fff6b9412c2843dba8bbfd42694f5633780a0f0e5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        orbd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
        • Size 13.5MB
        • SHA256 bbdc44c22dd82a7c9c8796b7f8d90e2c0beaf9d127c150714bcd02947aa3eed1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dotnet.exe
        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 22.5MB
        • SHA256 d8a2eb14fbb1ab6efd6c4005765c64f5a297fcea0dbe679c861fac9fc050c94b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 19.6MB
        • SHA256 5a0ae4d2ae32b17b5a1dce870332618d0da6be5358b28dd58e30b2bebba5cd3d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 17.2MB
        • SHA256 ad3b91dc23edd660f6589ef4d723d6483f220f1e4ffb20c5fbb7446f72d4b8a5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 19.7MB
        • SHA256 2bb7904f67b051db8a3598e826c8cc33ff206022e42652a1992dce500a8ae3b2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download