Overview

overview

8

Static

static

3

2026-07-30...ar.exe

windows10-2004-x64

8

2026-07-30...ar.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    150s
  • max time network
    98s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    30/07/2026, 17:20

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-07-30_90b938f04e04d4d30000a0c9fbc08bd2_cobalt-strike_elex_emotet_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe
  • Size 6.7MB
  • Sample260730-vwkclawye1
  • SHA256 522d09fdb6a4b0e5f35a44d1e30ca2866a26eb1e2bd12811f4938c61327e380c
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
defense_evasiondiscoverypersistenceransomware

Malware Config

Signatures

  • Drops file in Drivers directory 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Sets desktop wallpaper using registry 2 TTPs 2 IoCs
    ransomware
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies Control Panel 4 IoCs
    defense_evasion
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-07-30_90b938f04e04d4d30000a0c9fbc08bd2_cobalt-strike_elex_emotet_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-07-30_90b938f04e04d4d30000a0c9fbc08bd2_cobalt-strike_elex_emotet_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:4360
  • C:\Users\Admin\AppData\Local\Temp\2026-07-30_90b938f04e04d4d30000a0c9fbc08bd2_cobalt-strike_elex_emotet_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe
    C:\Users\Admin\AppData\Local\Temp/2026-07-30_90b938f04e04d4d30000a0c9fbc08bd2_cobalt-strike_elex_emotet_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:4796

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        7z.exe
        • Path C:\Program Files\7-Zip\7z.exe
        • Size 7.2MB
        • SHA256 077d860629914bf80c8f9dbf94aca0208be699f13e35e3b160f9c2a5f1ff7c2b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        7zFM.exe
        • Path C:\Program Files\7-Zip\7zFM.exe
        • Size 14.4MB
        • SHA256 f9d3d52460b4b87f2f00919ff5806863ffafa530314a02d297e491f81389d080
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        7zG.exe
        • Path C:\Program Files\7-Zip\7zG.exe
        • Size 14.1MB
        • SHA256 ca0be6c60ae2f552a1106ac85786df41c061a1b9ee68ea6a95c57176f3b5fcff
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Uninstall.exe
        • Path C:\Program Files\7-Zip\Uninstall.exe
        • Size 13.4MB
        • SHA256 c915f7b7ddb99904b6f403b497e9d7d9223c38a235d122c1a643e57381e96bc0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        AppVShNotify.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
        • Size 13.7MB
        • SHA256 c6e2e9baf0ac1e1ce7318b81ab9c38c91f9cd9583c5288fc993da6a375d85359
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        InspectorOfficeGadget.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
        • Size 13.5MB
        • SHA256 1f425ce6a26852f81a108c5d8b6c6ecdf5599fc5642fa7e55e82d73bafbb9324
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        IntegratedOffice.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
        • Size 10.8MB
        • SHA256 735a1a3c08a1b8f14ec9e240a2b525345909a976814cfdfa5321b598fd6ba7f7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MavInject32.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
        • Size 13.8MB
        • SHA256 68a4948f5c3223c7076eca34d5017d7b98f9327b80ab4fd00be90eaa01452040
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        OfficeC2RClient.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
        • Size 36.9MB
        • SHA256 29edfc9c689b7cacab2f59000919ad973197f094f9dc4a108dd332952ff80a5a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appvcleaner.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
        • Size 15.6MB
        • SHA256 ae6e06e437f1a2ab550771c0497e996b0abb73d2b426da190d817f6967108966
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VSTOInstaller.exe
        • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
        • Size 13.5MB
        • SHA256 6089c2b6fec31a5a50ea0dba51fb27f5b097964e7f85eb091cf3d1a5648c44e7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrmstp.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        • Size 19.5MB
        • SHA256 c202c7a2b0fccd17244506633d6921fd0c6a884587ba27032c18b58c01695079
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_pwa_launcher.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 15.1MB
        • SHA256 6509dbfddbb2a24950902c26738ebb98d698869ac16cecd5b9cbf3d5d5b64b40
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevated_tracing_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 16.9MB
        • SHA256 870f55540932f955309adb589ddf0508434cb51ffde569dc5f669b63765fc0fe
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 15.7MB
        • SHA256 318a995b34ced1a0fb7e3b11ca1a3096a831d8668ed18aecce42d2280c5e228f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notification_helper.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 8.3MB
        • SHA256 06e46143e26d487106a69c203ee9b3a7ba72327b17e029984586655faea25f6a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 16.5MB
        • SHA256 3b367028c8d2579a1024534e835d12b36a05c5f88405bf280912b1f55a4176f3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_proxy.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 14.8MB
        • SHA256 217d9c1a8c94a48c4ad63052a2ab89f142ba602a641fc36ceed1dd5712bc738d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 13.4MB
        • SHA256 cbcddc5fd75c5d20cf8ce25cfb7e3b6b0e771e25255e9655e6553a40bf44baf8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 13.4MB
        • SHA256 f32023ad0b76321aa041e3ab64fcda0bf061a8328d8d03bf070f82a6bd2e8eab
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 13.4MB
        • SHA256 372d889969dcfcf743dee8084a79fc2a74029ddf1f37bbb5d813531eb6521062
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 13.5MB
        • SHA256 0f7cf95c145d3fb46ecfbb21d7052f3905f6369885cbff07ce8b0cd09bcb02af
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jar.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 13.4MB
        • SHA256 2d86891a80d37e7750ab886283e47415f6e6c0b19e7ab3ef30c5b551a6a195c3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jarsigner.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        • Size 13.4MB
        • SHA256 298376e401e3c3d88c4fc26e511eeb9db4026c6a3e69ee076c0ca657bb8f6b66
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 13.4MB
        • SHA256 f7a5fccf820e01e6b79abdac5063872733f8977a707e8ef3d90db8943906ea70
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
        • Size 13.7MB
        • SHA256 c7a7441e765574080fbcb29f78a81351f4fbd5b2688052119e63518df2719ce0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javac.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
        • Size 13.4MB
        • SHA256 4ab6db8ed022a24ad538f531c187655c5d86098b1e10223945fa391115c58ac1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javadoc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
        • Size 13.4MB
        • SHA256 21b05b7ede899653851b05e90525f00e05280608ed27f97e5624e1d4ef7b3796
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javafxpackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
        • Size 13.6MB
        • SHA256 243e1e455d8653cdd92b0e434ab97f230ed88972e59b561780699bc41aa10edd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javah.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
        • Size 13.4MB
        • SHA256 31bca37b46785421a7f771e7e810c363efcd4605de82e84aeddefa7517e00141
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
        • Size 13.4MB
        • SHA256 5988775467374e976a2fd758e1c7e0665697515b4612b2350fd94f9788b80396
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javapackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
        • Size 13.6MB
        • SHA256 f42d26479ad83eff1b8237e8894f79761608f791bcb57221343655055d618cd2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaw.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
        • Size 13.7MB
        • SHA256 94717b7203486aec70edec3c41eec3f6be7b419fdbe00f03b533d902fcf6fe83
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
        • Size 13.9MB
        • SHA256 e9feffb66d46511a319a7ea2bc0bf8700d741f7ad197b93efe1f8191f7a1a3fd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jcmd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
        • Size 13.4MB
        • SHA256 77fc0127748c04fa542610ccf66efc2548fb30da5543f929b61de982e09be44a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jconsole.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
        • Size 13.4MB
        • SHA256 2ed8ad69055114cea2448e9caa9889d55d45192d95d0abe06fca5921c10f7ef0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdb.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
        • Size 13.4MB
        • SHA256 b83d5507ad2829db6fd2e1153e621d127e2718f3d99100e839bd94bff0004af8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdeps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
        • Size 13.4MB
        • SHA256 c464b307c41f4a9f3713cdf052ce7f3ab22f1063179f92a736d385a1eb40e9f1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jhat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
        • Size 13.4MB
        • SHA256 81c512de387b071d49031113fdc9881dc8151f7065b7aec629049992e753d6da
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jinfo.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
        • Size 13.4MB
        • SHA256 b221ab252fdcffbbbfd63f8a2641271a20478ca521565ece863030fb29e03b43
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jjs.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
        • Size 13.4MB
        • SHA256 135660307ecad3f22ab5eae30ca81c957df6a40b1305fa68821d8f471cf42316
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jmap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
        • Size 13.4MB
        • SHA256 402551ae100d3caaebd4654bdb25ab0d66919b61626cc91269ebb3ee3b796348
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
        • Size 13.4MB
        • SHA256 b0c22b6c4c596895e81bce7c287177c612cd52e5b17962a5cebf4265f815ebe1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jrunscript.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
        • Size 13.4MB
        • SHA256 18ec828777a36055293969dc79797f29b315313a8bdfe16e7dbac58e163c1d10
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jsadebugd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
        • Size 13.4MB
        • SHA256 974ec29cc4f63b03aa85a66b3240bab9956ec7187b0e2ab90c2ed45594b953e0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstack.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
        • Size 13.4MB
        • SHA256 2bdd69419eb688a85d65ed6355e6fd18340291a613b92e1f4508a9403a103881
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
        • Size 13.4MB
        • SHA256 ab5bacd69cc6a5df29ce016af36971d44d3e815346373c20993145ad031d83ac
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstatd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
        • Size 13.4MB
        • SHA256 aceeed1588d35641904bfdd3955d0344e59e97eaca1ae57afb368e34f08fc049
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        keytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
        • Size 13.4MB
        • SHA256 95fddffdc0da10aa8ab1ce2ea382ff42ded99d2a9a111027f15331cae691c445
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        kinit.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
        • Size 13.4MB
        • SHA256 60dc899a93796bf2556f89c72ae9df1e6cbe5517a883a14b43e3b23675324f29
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        klist.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
        • Size 13.4MB
        • SHA256 3976ecde64605c2f8f36cd31424a85b8c70be7c31b5a7fee8ab860f9c9fd4796
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ktab.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
        • Size 13.4MB
        • SHA256 cfcc210affba7ce09bab48f16b2d91b07433a45c8a2949f1dda3e21483c44190
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        native2ascii.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
        • Size 13.4MB
        • SHA256 13eae3aa79edd7cfc079fd8112d47d7e810065ffbf9969a8f332d9f265c38edd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        orbd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
        • Size 13.4MB
        • SHA256 4bf18b3c003bb90b9d0188d55250478bb7ea428dec61ad728223eefa5c0d9bb3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
        • Size 13.4MB
        • SHA256 18b807d103a9414698c35c811d9c268510217faab6081c23cf362c65a565a5ed
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        policytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
        • Size 13.4MB
        • SHA256 c6d30d393f40d7676e400a9c1b4b6198d719d28f0499745458de60b0ae5df0a1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmic.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
        • Size 13.4MB
        • SHA256 21fdbf135d1044a1c1bcf60bcca4711aa5bcd585076bcbfa8f6a26737072ccfd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmid.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
        • Size 13.4MB
        • SHA256 5beeb1f7d9e137fe830fc14cd8171137cbef881dfd5201dedce1c5eb69594170
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dotnet.exe
        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 13.6MB
        • SHA256 872787692b89ce6120343a2fc092f015f8357b60a2ac75e446daaeb3391a9725
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 13.5MB
        • SHA256 34c092c6b62a354c244c9b5e1e709656925d30386a359729928838d477a7e2fa
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 13.5MB
        • SHA256 62367ab3982d5d76821eb41d05dda75176789fda325d6c43966bffbe556ba672
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 13.5MB
        • SHA256 f6cdb60098d92959abba3aca2cf5fdd34c79c2a7e7346d6cfa73ec004bcf5e60
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download