Overview

overview

8

Static

static

3

2026-07-30...ar.exe

windows10-2004-x64

8

2026-07-30...ar.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    150s
  • max time network
    116s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    30/07/2026, 17:41

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-07-30_570c31eec8640a7ffd58f408b3883159_cobalt-strike_elex_emotet_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe
  • Size 12.9MB
  • Sample260730-v9j9ratdrf
  • SHA256 cb0d25991c8f5c8ecb31a29284b21142ebe4f2b0b02cc86fc471ec22ce871c8d
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
defense_evasiondiscoverypersistenceransomware

Malware Config

Signatures

  • Drops file in Drivers directory 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Sets desktop wallpaper using registry 2 TTPs 2 IoCs
    ransomware
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies Control Panel 4 IoCs
    defense_evasion
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-07-30_570c31eec8640a7ffd58f408b3883159_cobalt-strike_elex_emotet_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-07-30_570c31eec8640a7ffd58f408b3883159_cobalt-strike_elex_emotet_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:4844
  • C:\Users\Admin\AppData\Local\Temp\2026-07-30_570c31eec8640a7ffd58f408b3883159_cobalt-strike_elex_emotet_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe
    C:\Users\Admin\AppData\Local\Temp/2026-07-30_570c31eec8640a7ffd58f408b3883159_cobalt-strike_elex_emotet_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:5048

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        Uninstall.exe
        • Path C:\Program Files\7-Zip\Uninstall.exe
        • Size 13.0MB
        • SHA256 deada281901e3236094dab5cd4dd638b70cef1cbeb0322014ab108af292b64e9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        AppVShNotify.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
        • Size 26.2MB
        • SHA256 49c31b828a5374a3841cbe5d01c2fe12f125ab57713289fa257977b060414dce
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        InspectorOfficeGadget.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
        • Size 25.9MB
        • SHA256 b5332e795d0987e3e7b49ed2962893cc71ea4172db2f0dc7f02137590b7575cc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        IntegratedOffice.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
        • Size 30.0MB
        • SHA256 7e121837bdb3b3f85cf80550b04d5d4244fa9e392edad3893bfa17e54657ad57
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MavInject32.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
        • Size 26.2MB
        • SHA256 fa89ea37edd6344757534bcdf33d5355464830aae7b5002eaf237f6b41c33b30
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appvcleaner.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
        • Size 15.1MB
        • SHA256 c45585fbff7164db422d572554ebbc686053992293f558cd626778c0c9df9390
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VSTOInstaller.exe
        • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
        • Size 26.0MB
        • SHA256 0e067fa70fb9ae97936c405e2132cddc444e81ce1fded15b613da2d8f1e1cb1a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrmstp.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        • Size 31.9MB
        • SHA256 181e9bf09ad70fd177548119033e824c9f7902dcfcdb80e07b9e23a16a1972a7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_pwa_launcher.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 27.6MB
        • SHA256 fe24b1aa7dff2d6135a1596c12f8f4665a574a4b42802f75f9ef7bd36a5d78b0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevated_tracing_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 29.3MB
        • SHA256 14959345feae71195ba171e718b1ee445beab242b9dfec3448e41b8b5ac83ada
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 28.1MB
        • SHA256 e31664ad4fe6d0cd2585e8f6dcb203c1789c09bddd93f78a3795a05d8b30995e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notification_helper.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 27.5MB
        • SHA256 f61b68d49ad9d581c3376127c97f5427f28baf97b0efb173391de215620f7f65
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        os_update_handler.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 27.7MB
        • SHA256 e380c7a90abdb93b752be7a119ca028b720ca64a92e38c838e0ae478a138dfa7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 28.9MB
        • SHA256 93b0a68edc7f8ca4d790482fb0b60c0ef5e5befbde9d46d3653f80dbcf19eee6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_proxy.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 27.3MB
        • SHA256 07e52cc72aa0e8cdeec042fdcf8af30ac3afec96fdbd64a21653d63d141962e5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 25.9MB
        • SHA256 21957f56f47c0130ef4aaf76fe682376900e47df1f5485c3daad9f0a03206953
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 25.9MB
        • SHA256 4c1b5562c179f86ad765bac027237218f2d956d4ec37d06c38a860739bf1e2eb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 25.9MB
        • SHA256 2a3aa27605b442909f09f973427098856181352f14ffcb6efb6d7a9623d2e8bf
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 25.9MB
        • SHA256 b77fb2c4b09ab4bced99deb5a26eedfd5a04e598c1f456ba4a386ec31675f082
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jar.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 25.9MB
        • SHA256 44603b69978e72dfe7f5c7007ce7f9bd3e44b660e5c39f3c8c5ed8c399fbc99a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jarsigner.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        • Size 25.9MB
        • SHA256 d02aad9d4181310f4ab8947143fc9f544fb222fa9e8cb0ff4d5916236a4bebe2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 25.9MB
        • SHA256 78d98e115338163b79e0483f4307ee8403ad103dfde6f31bc49359246b5492c6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
        • Size 26.2MB
        • SHA256 67721a0f5f1eadd834347ef308330423402a5ab2c951a6dd490ee98ed2d9500d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javac.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
        • Size 25.9MB
        • SHA256 b6aaca29c0ab5d2d2503d15fa5e44ef4aaae0e046170bbc6fa432cf1471818c8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javadoc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
        • Size 12.9MB
        • SHA256 cb0d25991c8f5c8ecb31a29284b21142ebe4f2b0b02cc86fc471ec22ce871c8d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javafxpackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
        • Size 13.1MB
        • SHA256 cb2cc6a12a6bbb7c348483893046411660719e8817433642e336bf68a1101687
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javah.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
        • Size 25.9MB
        • SHA256 7e29bc06aae83a7e8b6e25f0760cbdafce7ed6a78b774b659cc2528cc7c87ee3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
        • Size 25.9MB
        • SHA256 b845f430c925a0369a670cf8f94b278ab54f5bd2618699870556c3f3570c1503
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javapackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
        • Size 26.0MB
        • SHA256 30f2bffd4e3463efe6ea3c435eae88dc783e87fb6030bf64eee3a53ea4ddffff
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaw.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
        • Size 26.2MB
        • SHA256 a1916417c347483ae747b304f7d83b29457fc46fc14d2f4b686a06284c8a2051
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
        • Size 26.3MB
        • SHA256 2180acbc6e1aa2b2f44b7f47cba7a8ea3ba49d8772a8d7fecc1a181eb13b6baf
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jcmd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
        • Size 128KB
        • SHA256 e52488a8a3c5c15a2f928eb2127c84d20ca0143b2598bd3c627a271a6a7a3d72
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jconsole.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
        • Size 25.9MB
        • SHA256 733ba215795a24829849b45555b42b44668a924336674266309b76f16b7a1008
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdb.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
        • Size 25.9MB
        • SHA256 7e8a8a34c855b09b5736c6742f2943d49873977cd7eb22d5a8e69fa9323304b7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdeps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
        • Size 25.9MB
        • SHA256 d31771d8ca34352fe93a833f7c60b86d369d48afd74c2d6512f2fd05b15d73c4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jhat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
        • Size 25.9MB
        • SHA256 a11ea2f045ef8d5352d0c9f3ff8fe53bb9927e134f1ee46f7ecca6c8d95508d0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jinfo.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
        • Size 25.9MB
        • SHA256 176e40458ae0742cdcf214aa9430cf339c87d608719c577a414a10c8b0836394
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jjs.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
        • Size 25.9MB
        • SHA256 448c887d786f96ab1c89249c5acc51c7497367b1acb6fe8a9852cf4aca2ef9db
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jmap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
        • Size 25.9MB
        • SHA256 dc4dfc3fda77765bef941eefd2517cdac0b6bc3d19f3ffe0a14def29192b9cd1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
        • Size 25.9MB
        • SHA256 34096e59d49a3f72a4d041c866bc91e971169a49c022f2b3f7d01f4c3f694c85
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jrunscript.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
        • Size 25.9MB
        • SHA256 b1c170c4c8549925f8fe11ff57158ab09ebcf9d580e2058570de5fda10a3dae6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jsadebugd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
        • Size 25.9MB
        • SHA256 8d9ec15ffffc1fe49c343e59c417ffe384f368d57256766e9c7f1ff8e62e99d3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstack.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
        • Size 25.9MB
        • SHA256 8f8a690418a6745cc46d45293240c0408839d96427abc5defbd5657902d2c4b8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
        • Size 25.9MB
        • SHA256 05e0d3003061652ccf61c43d097d7a8f8dc44eb8c73af590891d227ef5088dad
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ktab.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
        • Size 25.9MB
        • SHA256 cdfbdbe5970aae5a366a38acb4701e7abbd69326888c53cf5207d1383bdbe234
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        native2ascii.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
        • Size 25.9MB
        • SHA256 c188c88eac7d53a67a9e63dea804578610c4c1d525c5ad0fa457bf1bd1db5e52
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        orbd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
        • Size 25.9MB
        • SHA256 03b91157a0192deb9beb91a16964f76c450eeb27ff8a9b77024a56f08dbc6850
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        policytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
        • Size 25.9MB
        • SHA256 19118a584f7611c2efe5900ae887fb4852f2c93c0c38c0cf18a4a314aa5ae3c2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmic.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
        • Size 25.9MB
        • SHA256 5435e4f5e2444c347eb1b7ccc3b9e85751279372d68798641ca0907a140dc366
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmid.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
        • Size 25.9MB
        • SHA256 fe49444c605becea158b517e7e1bd1c6ed20c6b8260920e2c4f59382c3573163
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmiregistry.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
        • Size 25.9MB
        • SHA256 dcdadf697f4ffd1395170ab50bfe220f08b8033c0429488c7ef2d376ed354588
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        schemagen.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
        • Size 25.9MB
        • SHA256 51387955aa9e3540cc55495de5d5a9f18eeec59924ef63c9385428ba040a899e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        serialver.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
        • Size 25.9MB
        • SHA256 aea31f5e907098fbc58c187c1d262cb171b7f824fc30260e8d2da4d02e8ad8c3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dotnet.exe
        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 26.0MB
        • SHA256 8e52873eb45891ea542dbbe0c3bed851039778bee102175051302722651e6752
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 25.9MB
        • SHA256 204732ceb6dc9ed0f99f936cc0adfc8caa760812d8fe046641aa799584988ae0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 25.9MB
        • SHA256 3a059d503a4ca36bde6413f6ab316ad0402e4371dcdf4ffcb29b4cb35581a3f2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 25.9MB
        • SHA256 04b545a2146f600a229484d22570fd760f89f1ca2889f319a961585db3602dca
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download