Overview

overview

8

Static

static

3

2026-08-01...ar.exe

windows10-2004-x64

8

2026-08-01...ar.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    148s
  • max time network
    116s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    01/08/2026, 14:19

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-01_1b7e16ef7d78372918d342feac8e41dc_elex_emotet_icedid_njrat_remcos_vidar.exe
  • Size 11.0MB
  • Sample260801-rmvv7ack71
  • SHA256 049c08a1f2db81ef660e9905e3b402de50f952c1cb84248c992cb6738d6ea836
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
defense_evasiondiscoverypersistenceransomware

Malware Config

Signatures

  • Drops file in Drivers directory 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Sets desktop wallpaper using registry 2 TTPs 2 IoCs
    ransomware
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies Control Panel 4 IoCs
    defense_evasion
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-01_1b7e16ef7d78372918d342feac8e41dc_elex_emotet_icedid_njrat_remcos_vidar.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-01_1b7e16ef7d78372918d342feac8e41dc_elex_emotet_icedid_njrat_remcos_vidar.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:1164
  • C:\Users\Admin\AppData\Local\Temp\2026-08-01_1b7e16ef7d78372918d342feac8e41dc_elex_emotet_icedid_njrat_remcos_vidar.exe
    C:\Users\Admin\AppData\Local\Temp/2026-08-01_1b7e16ef7d78372918d342feac8e41dc_elex_emotet_icedid_njrat_remcos_vidar.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:408

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        AppVShNotify.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
        • Size 11.0MB
        • SHA256 049c08a1f2db81ef660e9905e3b402de50f952c1cb84248c992cb6738d6ea836
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        InspectorOfficeGadget.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
        • Size 22.0MB
        • SHA256 4b052462abd422d1fb6a83383c75c5c429e9e3be54c67938dc8bd8014efe4a46
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        IntegratedOffice.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
        • Size 26.1MB
        • SHA256 fdf29159c8a40cc88913c6c0c989727e9d2ff86eecc386992de18b8d46021120
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MavInject32.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
        • Size 22.3MB
        • SHA256 487e6829f5ed3ee5698a026fce5070e25fed3e7012eeb76065419a5234c2fb9e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        OfficeC2RClient.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
        • Size 45.5MB
        • SHA256 c7b41241f63229a76bba23bd4849bdfe219dac912f6889b5200470727ab546b1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appvcleaner.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
        • Size 13.1MB
        • SHA256 ef318f79192bdcf11ef71048094076d14aa6efb07b1d1f7d9139d8fcb1fc5965
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VSTOInstaller.exe
        • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
        • Size 22.1MB
        • SHA256 a0bbacbfa75d61fd4139497094526ccb903ed7f86a4da4b9218f90aa25dbd005
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrmstp.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        • Size 28.0MB
        • SHA256 7cc2661edde09b208081b6406ede6b2c17155b15c4a1435f28c3fc84c2af0759
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_pwa_launcher.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 23.7MB
        • SHA256 082bce1ede2cd4d6e020d8f937f3cc3e912659f9aa6caf461c2952be6cdfb66c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevated_tracing_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 25.4MB
        • SHA256 a19863e3adc79060bdd7dde5bc6c745371794f9ed9959e1ff346867e5c83d997
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 24.3MB
        • SHA256 bc1de24a007ca56544391f53dab39865b1448e5441714463b599c8364c51613a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notification_helper.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 23.6MB
        • SHA256 e0840a05410a0d655a69a2e929e5b82513bdc61b3b778446957147d3e91f98cf
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        os_update_handler.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 23.8MB
        • SHA256 b0bda87cdc1e00528ea47bd0a2bcd4dfaf410936aba49a79dd16ddf2393d84d3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 25.1MB
        • SHA256 c9018b2a682ee1507837386411ee2ae524fe2085ea2067eaf8bcf0b0a94efb04
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_proxy.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 23.4MB
        • SHA256 9b12749d3d09edda0c97d8019de4f23c3d4526ae16aef2026442525e0b3e719a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 22.0MB
        • SHA256 0f8a6b81c18fea411bbd558eabaa5152fc3402de75750446a096c3204c8026e8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 22.0MB
        • SHA256 49f4cfecfb082cb7d9fbebbebd83073085790d0784ff1f4055719c3aa048364e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 22.0MB
        • SHA256 89aa9067f56d886a5acbd9b710646a0948bbaa9fb6e85dccc1ba13c6cde65482
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jar.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 22.0MB
        • SHA256 3b24f3d0dd1bf0a98e16561f99b1454ea2db99fd907418fd7ab1ef6c601edb79
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 22.0MB
        • SHA256 77122987313892fc5936e1485c59dbb3712dd444aff1bc1be270eb2b4d465867
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
        • Size 22.3MB
        • SHA256 d480e0ee61cceb7caf44d4d258a4188f014cd8badd7abde886aea6d8f37565f9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javafxpackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
        • Size 22.1MB
        • SHA256 ca93d27957790b6ccc416f336eda853a9140ee5a519f7684533b9e70ffb631b6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javah.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
        • Size 22.0MB
        • SHA256 e37877cf3ba6a35c00adc68f2b04ae3ba782c4dcac8a7fb180c00702ba127c37
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
        • Size 22.0MB
        • SHA256 2123b1dd620dc44eae29a68816c0d16bf120f390e4637a53d11a73dc0b20c383
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javapackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
        • Size 22.1MB
        • SHA256 6025a476298d24be304b5c9438ff8daa5cb7de23fc21b388cc8e66ed1ccf4210
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaw.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
        • Size 22.3MB
        • SHA256 43168b71ff045e0a9ef87f12f238e8f1da5ea742f628ecdf3522a213b97b35b2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
        • Size 22.4MB
        • SHA256 6bc118f245d3d40216efe7b771f9c9e487d81240c8e0f4585a593ea7e938dc05
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jcmd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
        • Size 22.0MB
        • SHA256 514b04149c203e5d53fcaf27562afc32f242843d1b2de7b278b0112b1ed8ab9a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jconsole.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
        • Size 128KB
        • SHA256 6af2bec699efa81371b34875c8fe7a3dcd60935909f1684a3de3416f422146ba
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdb.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
        • Size 22.0MB
        • SHA256 bfada74e444977589a5055be03217cad145604218a11d252f9459567f61de24b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdeps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
        • Size 22.0MB
        • SHA256 b8c4c8e310a3955c5fa2dae448333d44dfe0fa66ab1f4efeb52a00dfd827f9f2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jhat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
        • Size 22.0MB
        • SHA256 e5d1d4fb1c51ad05472c4916b9ff1f8834a2816ab09631f0d4027d3dd470fe9d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jinfo.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
        • Size 22.0MB
        • SHA256 3c0b38e72a2c10c403910f8bea7e0d326b9f2af0c9d9c9c16f67d93523bd4633
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jjs.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
        • Size 22.0MB
        • SHA256 734cf9fefc36ae18f94148a2adcc3c459efed443f17815f08c7c663b6399d8e9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jmap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
        • Size 22.0MB
        • SHA256 01485c98a1cc4b3040295e8dc2f028d6aa13ead39aaa5a8fd41fc64a8464452c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
        • Size 22.0MB
        • SHA256 4755207a6c949855fb380134588bea95402a435a2bc64aa12b18ed39ee5f47e5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jrunscript.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
        • Size 22.0MB
        • SHA256 d100059a68dd2b04dabb20bf87b247159eac2c01f051a30254b4b41b68466ae5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jsadebugd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
        • Size 22.0MB
        • SHA256 f574320e2b60e786bf00a651210942f66c0b6cb8e385a64b21d19f4753e46269
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstack.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
        • Size 22.0MB
        • SHA256 093ab19dddb998ea0cee215340c6704310cd9ba394361d5488742541e65cf5d5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
        • Size 22.0MB
        • SHA256 e4f026308c12bcb6ebe2c84862b982944ff8947054b74c62c4e560f5b4ca4277
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstatd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
        • Size 22.0MB
        • SHA256 1a5e7d1218f7bb337365eead29e0ecefa30ff80630ad6385c0c10571340cbc2c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        keytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
        • Size 22.0MB
        • SHA256 870f5050d0403d8b4aba29b1b2c4b59c9eecb767807c286f26e0c0ffe0218fb6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        kinit.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
        • Size 22.0MB
        • SHA256 281c058789dbbcbe22eae7cfa537a19fa4a3654dd7decdaa68125f881479e270
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        klist.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
        • Size 22.0MB
        • SHA256 ac46a34fab799f2d892cb3c27233b5f3d758bc9bffc4ddc56acc676069db9af0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ktab.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
        • Size 22.0MB
        • SHA256 0ddc38ad7fb240fa112fc68cfe322aaaf586596476bc26f41e4b5c4914582974
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        native2ascii.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
        • Size 22.0MB
        • SHA256 15c5d83a30ec53aab344ceecf4ed6f39aa3e473b789ac0a137f997d5b9b26baa
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
        • Size 22.0MB
        • SHA256 e97c10de7093a9e3a15ec65f2d9d2669f4588edaa02621625dcc5c282ee1ce8b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        policytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
        • Size 22.0MB
        • SHA256 8379ab4c7a9f0eaa706440105e2af9a391234bcbe07c7b6db001b5571b6068ac
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmic.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
        • Size 22.0MB
        • SHA256 47f2888d1575f6f6ff01f764a5673e4111ddc2e8b6a425e4050996882b93ff8f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        schemagen.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
        • Size 22.0MB
        • SHA256 f0f8236cdeac316926d91c6bfa174a311bc20a6ed42bfd9767b83f8b7751c7b8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        serialver.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
        • Size 22.0MB
        • SHA256 1931ff2bfa4e6dc076fc656e8ad7a1fde938e7fc71cd82fc98c12519abb27833
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        servertool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
        • Size 22.0MB
        • SHA256 ff4735f5d30bc1145ff39c3989ea885010ad0d902684e65f74bf6b30eaa9b885
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        tnameserv.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
        • Size 22.0MB
        • SHA256 bf4e2c5ccca835602c7d4f65dd8b203926684fdd1f5221fbcfc33af26ea6fa2d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dotnet.exe
        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 22.1MB
        • SHA256 81065967087c57322d5b019086eeca32535cbd20dfcfb237effd40b058422d2b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 22.0MB
        • SHA256 3901e1f45baa0b37d432f1ebce1a2d6f51a5da775721c1cf5af00e4820245f3c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 22.0MB
        • SHA256 893147eb3dbd7de002f961fd0f811c0b2d8defb3171b1a5d8f62bce4e1c8f96c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 22.0MB
        • SHA256 33202d725678a180bc20151b27d6ad45abaa9d0162000005658ba86467792ba9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download