Overview

overview

8

Static

static

3

2026-08-01...ar.exe

windows10-2004-x64

8

2026-08-01...ar.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    149s
  • max time network
    136s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    02/08/2026, 00:53

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-01_4420286c9faa9db457bc58d768606725_elex_emotet_icedid_njrat_remcos_vidar.exe
  • Size 11.0MB
  • Sample260802-a83pgs1dka
  • SHA256 75e2e99332691034ec021b8c8c1449bfaca1005622002d5b2557b44b70648ecc
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
defense_evasiondiscoverypersistenceransomware

Malware Config

Signatures

  • Drops file in Drivers directory 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Sets desktop wallpaper using registry 2 TTPs 2 IoCs
    ransomware
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies Control Panel 4 IoCs
    defense_evasion
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-01_4420286c9faa9db457bc58d768606725_elex_emotet_icedid_njrat_remcos_vidar.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-01_4420286c9faa9db457bc58d768606725_elex_emotet_icedid_njrat_remcos_vidar.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:5616
  • C:\Users\Admin\AppData\Local\Temp\2026-08-01_4420286c9faa9db457bc58d768606725_elex_emotet_icedid_njrat_remcos_vidar.exe
    C:\Users\Admin\AppData\Local\Temp/2026-08-01_4420286c9faa9db457bc58d768606725_elex_emotet_icedid_njrat_remcos_vidar.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:1096

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        7z.exe
        • Path C:\Program Files\7-Zip\7z.exe
        • Size 11.6MB
        • SHA256 0913328d0bfd9ff8b6a87c30682e301edb650a79ee394f7c52e4e615afcfaf70
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        7zG.exe
        • Path C:\Program Files\7-Zip\7zG.exe
        • Size 11.7MB
        • SHA256 f503b4b7382be15eaa2dd6c4a0e7e41bc5d515a89bbbb083383b4288fc5888c4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Uninstall.exe
        • Path C:\Program Files\7-Zip\Uninstall.exe
        • Size 22.1MB
        • SHA256 81f75dafd457ed7d315159323e56946eea2956a601399fbb5eef7a90731ff2e0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        AppVShNotify.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
        • Size 22.4MB
        • SHA256 b9749f0b0a548abe8c0524335fc0902110e2cf8ccf5c1529409e595de16f718a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        InspectorOfficeGadget.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
        • Size 22.1MB
        • SHA256 0fd5a130629d3efd63cd45c4d148909bb3d4b16071bc42f2dc5f6a9f2b0881c3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        IntegratedOffice.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
        • Size 26.2MB
        • SHA256 d1db6d33bd9d704fb935bec6c2e637c7af0a8bd69c58d1708b17ecb5328201e6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MavInject32.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
        • Size 22.4MB
        • SHA256 77aab8ce7dec0938442c22861c4b91c78a74ac2a98b94013af61d813785f624e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        OfficeC2RClient.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
        • Size 45.6MB
        • SHA256 abcea478eb68b0fe4fbd9a86d1980236bbdcb9760b81dbeb274ab8827a30ed4a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appvcleaner.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
        • Size 13.2MB
        • SHA256 2f245a2bfefde3e5a5ad1e2ae039551282607143627495a5c49bb35cedbfc5d5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VSTOInstaller.exe
        • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
        • Size 22.2MB
        • SHA256 33cdbfc0baa70338b14ee713edc610827731c495b58e8c0ff27784f79f3158ad
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrmstp.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        • Size 28.1MB
        • SHA256 2472ae5aebf24c1a2d3c6cc1477926097357fc5b3e47283dafac744f03d3d7c3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_pwa_launcher.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 23.8MB
        • SHA256 f74eb938348714facb8cfe65e0ee38a0f066e0fea80a3dcb24a9c558f01c7191
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevated_tracing_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 25.5MB
        • SHA256 3b6422dd9a99afaa504d65b8034e7aad470ce9e94bcb7a9cbafa15974fa3d1e0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 24.3MB
        • SHA256 8ca979268921f70fe29e99841de1b8bc5cd626120607d09c42c7807c0dc8a4aa
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notification_helper.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 23.7MB
        • SHA256 35d092fafaeb70e7a059963da7ffabd943151ce782fbabc0d31aca3daf879822
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        os_update_handler.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 23.9MB
        • SHA256 63f8e7d570e0e618d0141d37d63f90126fe645a4c5a9690243d2202eb463725f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 25.2MB
        • SHA256 38c14202ccb40eb44ad9a5142f35c127c8ecc9f00ae627aace56bc85c7aed2f0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_proxy.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 23.5MB
        • SHA256 47d3358effc03d24153081e3d412522a7eb86a4d085f076fd0f465851efd572c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 22.1MB
        • SHA256 282d3f7360ad4547fa9d66b137b4926f6f75499093a2f95bbe669122e859329d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 22.1MB
        • SHA256 89b94a1775f62b5e0d0051f39a3d38dda3465d5de24c98eef56e66d99a45e230
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 22.1MB
        • SHA256 91e4e7fdc54bb157733b57ffada1999ac2fffcd37801766e551559af5eb6ce79
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 22.1MB
        • SHA256 a3974a4702c127f0eb5e53c313550fd78c464b546623fb1e0c4d58b1bf8aa6ff
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jar.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 22.1MB
        • SHA256 03b79ad4d3c894bbe108a6081536a5e8d2c9e552a781615cc64a877c32bbffa8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jarsigner.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        • Size 22.1MB
        • SHA256 eacbc98400e20bcb419d1134600a38446165684a4422907aadbc82331412e312
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 22.1MB
        • SHA256 cb84c1d06580c21fd56adc8c3e6f2d245fa2461b6cdf6e8bbfc63bb539f591eb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
        • Size 22.4MB
        • SHA256 d712a763bf0536716ac5b36541d84065c2d19ab14d10e9f812844fb9d6689845
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javafxpackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
        • Size 22.2MB
        • SHA256 0574a7171beeb0435dca09acc8ab89dc9efd9124822a604a5324a559c1779f3b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javah.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
        • Size 22.1MB
        • SHA256 983f56319a034532a309a67f6c36dab3b1015f2f824988c45efbb2b0621089fc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
        • Size 22.1MB
        • SHA256 e669359b411d33be22a21a0fd04a82fa9be50b6945f07c0693f0b63e84ba951a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javapackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
        • Size 22.2MB
        • SHA256 24265e13094695b5bd99704e166d990713d8af2393dee2ada3bd7c15cc5642a5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaw.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
        • Size 22.4MB
        • SHA256 ea72c942a0115e0dc9b523feb0b6f23e1589868a89b2a2eed22a3d0d93e19e8f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
        • Size 22.5MB
        • SHA256 e1508eb52dc0a5a384cdf0b7ff3911185ef96b8baf1a504c544fd397ab2c9007
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jcmd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
        • Size 22.1MB
        • SHA256 200d76430595f716c4756e186d6946b50794613583fab35eb8563fc93da45833
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jconsole.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
        • Size 22.1MB
        • SHA256 d249d4bdee1c099c338199e13047e096da6f8c37c7ab6115be8a4f577c7dbb1f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdb.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
        • Size 22.1MB
        • SHA256 db6b9b9fbff50f1bb1c04a2c249c3ec34ddb8fb2c8f9d85856bd144aaffc47b8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdeps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
        • Size 22.1MB
        • SHA256 b4bcb6a908f352127920cc91e95ee83162ed4cf61a4b6af8300ce838f1df8e49
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jhat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
        • Size 22.1MB
        • SHA256 b3a6bf3f99f99f7c0ff9332ceefd12376728bf4edabd4e9261e4dc5fd9ec00eb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jinfo.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
        • Size 22.1MB
        • SHA256 fc9f51ca737750d92d82accad33386615b013c8238ad35723710ec65dd902b96
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jjs.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
        • Size 22.1MB
        • SHA256 125085214b6bddb047fcb1135d3e308788a4ae45a04a14233df706e29d0cf583
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jmap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
        • Size 22.1MB
        • SHA256 2ed27b5721085ef42f106e564560ddcf87a6ef6ac6e401a2cdd237c3b0072742
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
        • Size 22.1MB
        • SHA256 fe062218413c9027639e482427f209db447d3e59d3bc95a97767d37bcf5386d6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstack.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
        • Size 22.1MB
        • SHA256 ef073d063b217deea4bbfbc2aed01e97bd02255004e4b88acd77f93d383b3cd9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
        • Size 22.1MB
        • SHA256 3c3f63a99e6b52d01655869a91e5bee4934c1d264123dd54944f62c9d205e165
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstatd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
        • Size 22.1MB
        • SHA256 60e71ad6e66267c8481b534b92e6ed0e575a3b6f4ac38eddf5394b4dcef52f59
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        keytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
        • Size 22.1MB
        • SHA256 d698d9d3b9cdc9311701e467e37f795e1e6a5b53ac97834af1f313565f28641f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        kinit.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
        • Size 22.1MB
        • SHA256 ea7817270df56e6e495bd4579b7cefca8be36b162f2fd3ffae7ed139e211f238
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        klist.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
        • Size 22.1MB
        • SHA256 be8fff38a7e7ca4e18df9dc3b07957ffda7530b0e8d2abf4ed2f4f7b328f8c48
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ktab.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
        • Size 22.1MB
        • SHA256 8b824752382809ffbe46e0a8c687b09050919e38632c17464599ca285e650975
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        native2ascii.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
        • Size 22.1MB
        • SHA256 78a4cd06f2b5c67524bea8971491b696f37e836a1906967fbfe71b8f313122d0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
        • Size 22.1MB
        • SHA256 5bd5b214ed00f6a761dcb3daebdeb73394d3527a4f5e8ff55a25525914e3f649
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        policytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
        • Size 22.1MB
        • SHA256 49ce17a67fc6a6ea63351566c98901fff6b5aab24eb784708af210c5d28cd5cc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmic.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
        • Size 22.1MB
        • SHA256 ebf83e37d60af57279164fe64ec0570e279b14fdb2f8fc52ab198d6067fc6ed8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmid.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
        • Size 22.1MB
        • SHA256 436ff667de8359ab409c6379cdfea8d50945eb6e8057e3fe44879b997b774e30
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmiregistry.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
        • Size 22.1MB
        • SHA256 0db9fb85905f88418321a182073aa24b27a3a419521b616a80bc930846753cad
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dotnet.exe
        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 22.2MB
        • SHA256 fa632aaf3487bfea37b5bcd2fff3c991a584f262a7175c8d5e71c539bd989459
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 22.1MB
        • SHA256 d2fbc8568accf83b3933f39e0531f8815c5665607c5fd9944aca96b1cf19948a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 22.1MB
        • SHA256 8aa7f4837c3565eea07c18031098985a7299d69d1cd399a8ed04bb57e2883499
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 22.1MB
        • SHA256 5bf11b3000b168900c889898c3a5e9b2f411e35910a0480dc6bfb59caac52b69
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download