Overview

overview

8

Static

static

3

2026-08-02...ar.exe

windows10-2004-x64

8

2026-08-02...ar.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    150s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260513-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    02/08/2026, 23:43

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-02_c262c1e9e4361a8d63873dcdba04450e_elex_emotet_glassworm_icedid_njrat_remcos_vidar.exe
  • Size 14.5MB
  • Sample260802-3q1rdstfle
  • SHA256 7fda616eda8f646980081ef1409070e32499667cad436f89d0cbf7e2439e8547
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
defense_evasiondiscoverypersistenceransomware

Malware Config

Signatures

  • Drops file in Drivers directory 3 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Sets desktop wallpaper using registry 2 TTPs 1 IoCs
    ransomware
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies Control Panel 2 IoCs
    defense_evasion
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-02_c262c1e9e4361a8d63873dcdba04450e_elex_emotet_glassworm_icedid_njrat_remcos_vidar.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-02_c262c1e9e4361a8d63873dcdba04450e_elex_emotet_glassworm_icedid_njrat_remcos_vidar.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:4304
  • C:\Users\Admin\AppData\Local\Temp\2026-08-02_c262c1e9e4361a8d63873dcdba04450e_elex_emotet_glassworm_icedid_njrat_remcos_vidar.exe
    C:\Users\Admin\AppData\Local\Temp/2026-08-02_c262c1e9e4361a8d63873dcdba04450e_elex_emotet_glassworm_icedid_njrat_remcos_vidar.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:4244

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        7z.exe
        • Path C:\Program Files\7-Zip\7z.exe
        • Size 15.1MB
        • SHA256 891a5a9cc01bd864b5fbce5673ba04bef070a733fe44b384ab4ec6cdfc60abb1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        7zFM.exe
        • Path C:\Program Files\7-Zip\7zFM.exe
        • Size 15.5MB
        • SHA256 e6a5a3294336cea50b30662353ad2e97a14427faaaf12447d505bef63ac698c2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        AppVShNotify.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
        • Size 29.3MB
        • SHA256 4c4b64a68d9c269cbb52d7652dd7238c9653db26352bb6355c254381f8a59b71
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        IntegratedOffice.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
        • Size 33.1MB
        • SHA256 38380082635044202d8bfdfb5e302bd5396e6d0a3b989e95d6b8cf9220b117c4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MavInject32.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
        • Size 29.4MB
        • SHA256 721978edf13304451ab8f6c4457133a63ed30a1853711168060d4ba4c2833a73
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        OfficeC2RClient.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
        • Size 52.5MB
        • SHA256 a45eee36909b00df5eb4029897125f4848a65d00341a6950dc9fc3820ff7daab
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appvcleaner.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
        • Size 16.6MB
        • SHA256 64c8147ee64831db0221dfc35203805d6700aeb6f46c73ab45138f8f4378f050
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VSTOInstaller.exe
        • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
        • Size 29.1MB
        • SHA256 db257b435ce62fba1aac45251eface3f958ea2e4726267d7fde74cc170c12071
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrmstp.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        • Size 35.1MB
        • SHA256 f13081184669d04ee4f726ee4172ac3790957f5105700ff1330e26b2df1a3df7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_pwa_launcher.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 30.8MB
        • SHA256 d5c3bea2817a0d3bfbe4fa5c4641bdb26cf015ce7fcbfd147c72c1505d4ed797
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevated_tracing_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 32.5MB
        • SHA256 aaa888b44197dbce37395d18eec012a5fa68066589b3975da365b31d74cd66a8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 31.3MB
        • SHA256 c18f0966ab7c87151d33749935b9a7d02f961518e0275a12d78be702a2f6203e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notification_helper.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 30.7MB
        • SHA256 c89f8f5edfbff533293fdc80ee1b630fb98395c770275fd7a00db497cc2c0328
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        os_update_handler.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 30.9MB
        • SHA256 7cc79dfa1b01df2380ea067dd1c9f10cabe037b4dc7696a359e6798418a0f6bc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 32.1MB
        • SHA256 d280a398bbd47bd7f93044821cb278ce4e28a35109612b981eee642eb00ac45d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_proxy.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 30.5MB
        • SHA256 37d418b9bb752b1b4fca87116e52fdba9dac82b93f4945f4a85b86a80b30c6fc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 29.1MB
        • SHA256 c1dbeb24bf74ba96f92621b7aefdf12a24b972e71581fc65ffe227209b22bd83
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 29.1MB
        • SHA256 28bfca9321b13ef2a033c1474ded22e6aed715d7e58d646db9e805ac45b67360
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 29.1MB
        • SHA256 f508e584b3f507eb3f10954a202439710dc02859a8cf0f3ff015cbbb793ad606
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jar.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 29.1MB
        • SHA256 0519d341356f3ab11d74bdde60b0941110127d64c9d898dcce731ed7d955bed5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jarsigner.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        • Size 29.1MB
        • SHA256 71bb71a7527a802cdcba53a9b99611fcd1f85188e39e112a9b7256c00b7aa322
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 29.1MB
        • SHA256 b5fdf6258b6eb8a4db3b93237a97c02e1943e6975c2c249405f1d6ffe69063ba
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
        • Size 29.3MB
        • SHA256 20f94ac844cdc128fbbdd7c885510f79d539ae42128ed6a11dbc389c176491d3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javadoc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
        • Size 29.1MB
        • SHA256 8d0ccc29299e774a8fbd1fca51742e06479baec207d95c3b8335c5e18588d541
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javafxpackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
        • Size 29.2MB
        • SHA256 1bca56b84e5e1955b694862f2a69ee41c2f3d501fdb290e66978b5242391e712
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javah.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
        • Size 29.1MB
        • SHA256 319735beab263764e3f154274cda193a64f3b087c0b8f934b051db849ccc54fc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
        • Size 29.1MB
        • SHA256 2d095feede6e7dbcf846a7d47faad80a628c4cae141d86a1940b0dfcab1fa6f3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javapackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
        • Size 29.2MB
        • SHA256 52d1ceec9c76606ca53ee4b6ff06c9ae308a821be54fac8f5d59b357d8e12714
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaw.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
        • Size 29.3MB
        • SHA256 6670f84344d1cf05180d41e9800688faa3aab039b64cd5449a55095f9cb83346
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
        • Size 29.5MB
        • SHA256 f8e3d709e9e55f699465e0421f023ddc0741351cf61d50e7889c81905b1f58c4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jcmd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
        • Size 29.1MB
        • SHA256 435a467f98ef7b2e6d93ade4817e280b830c30ad1c565faab745801ec04b05e0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jconsole.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
        • Size 29.1MB
        • SHA256 01f56c277b81f526ee262e6349b32bdb351df56a1651a54376da3fdde95f32a6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdb.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
        • Size 29.1MB
        • SHA256 dcfe9d4affd346748c999148f72419fe80ff93c4c7309b4f759b35c8b2c12f45
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdeps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
        • Size 29.1MB
        • SHA256 d41982589e01f3cfb7229acba7fda9edbc458f17f411aab9a6362150d1f9cac3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jhat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
        • Size 29.1MB
        • SHA256 2998583153417fc34cd601bfc940d815e39512685d4254286ed080dbc50f067e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jinfo.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
        • Size 29.1MB
        • SHA256 ad0ddb40bb967f975e88697480cc2439006c82a34f1a56c488143158cff23840
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jjs.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
        • Size 29.1MB
        • SHA256 fb7e9140491eadad4ce1001f12fd10cc465859d654dabd02eb122af86d14d5df
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jmap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
        • Size 29.1MB
        • SHA256 e697048be75b8ed16616fb3d5b456afd7e44039175be513d191d47a7f5e05272
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
        • Size 29.1MB
        • SHA256 bf31a110ba0885428fff15e3129e61578d35d42dc2be47cbcef780dd7c80ac81
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jrunscript.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
        • Size 29.1MB
        • SHA256 c2ee2bdefc9d0e9dec9be694761f81ff3653302cd6a5e85bda70a5de11865855
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jsadebugd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
        • Size 29.1MB
        • SHA256 ef32b4de1fc83b5e80eaee942395af7a023ec65c1418a7c2bcfef3f86fd24181
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstack.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
        • Size 29.1MB
        • SHA256 74a28b84cff19a825d87f50e2e4e8ec6d0f5789b2e404273bedfc20ee085449a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
        • Size 14.5MB
        • SHA256 9c21d1492c558573451af77efd210866877525304a6596da0663943d2f0ba35a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        kinit.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
        • Size 29.1MB
        • SHA256 ba1cde415d14ea5add3542e7dab5978447b0e40ae588ad672ecd57293e21e2eb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        klist.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
        • Size 29.1MB
        • SHA256 01db2200a2c475b0d1e28d0f092a74cbc81bbfaed999a1c65e8fe05d556e0f36
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ktab.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
        • Size 128KB
        • SHA256 018b597827351ef5fba9c0e1d321cfa9b45d887ff0f8d5607452eb75d8626cb5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        orbd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
        • Size 29.1MB
        • SHA256 31c2a7a85b8ef2d39e57012c26cc29476002ccc453140502ffd9bb2e9864a7da
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
        • Size 29.1MB
        • SHA256 70ec4fceeacf91ddefc4c363d2861ebe1fbe4f770a1fd3880a9b9358049d6dea
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        policytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
        • Size 29.1MB
        • SHA256 2472d47330f85100995ebd5f4dc51ea247f0e11331144d3d31b03d3b30f1030c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmic.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
        • Size 29.1MB
        • SHA256 2d1a2e3708d1774f9b7af6d85ce38e21776107a5e537cfbbb898d840aa73013c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmid.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
        • Size 29.1MB
        • SHA256 1ba789879c0443fe8017a1375d5fad7c167ce277e6b3d3d21e5614f1fe73dc21
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmiregistry.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
        • Size 29.1MB
        • SHA256 b20989640d88c7b929d72e2215be800c90fe1456f3f3382e001bbcf4612e489d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        schemagen.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
        • Size 29.1MB
        • SHA256 97d57a30cb284b896fc2914eb4df5b5e49b4c775058509e32c8a6e2cda79357f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dotnet.exe
        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 14.7MB
        • SHA256 0bfe441b3ce71d492753df14b41edf419848ac8c9ee47cfac36ba8947bf37f33
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 29.1MB
        • SHA256 ab29a62d63fc992bf2972a3f6b2721901e3a291440bccb1851ff09c6c822f6b6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 29.1MB
        • SHA256 36928b45217f77a02c15fb18988a38b4c7e6bb667a567851741ed542d60fc6c2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 29.1MB
        • SHA256 f10b4f0fecfdbe4e2a6e09132395f0318416b53481a3d4dfe7911aa8ca0c5079
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        spo0lve.exe
        • Path C:\windows\SysWOW64\drivers\spo0lve.exe
        • Size 14.5MB
        • SHA256 7fda616eda8f646980081ef1409070e32499667cad436f89d0cbf7e2439e8547
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/4244-5-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download

        memory/4304-0-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download

        memory/4304-4-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download