Overview

overview

8

Static

static

3

2026-08-01...ar.exe

windows10-2004-x64

8

2026-08-01...ar.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    150s
  • max time network
    146s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260710-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    02/08/2026, 00:55

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-01_3ee2863657f302a461fb40cb8770aa88_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
  • Size 9.2MB
  • Sample260802-a988naar21
  • SHA256 98711fdd637fcd438d4145c987d319bc8f5be26f52cb3a2680a3bb8ee625e2a3
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
defense_evasiondiscoverypersistenceransomware

Malware Config

Signatures

  • Drops file in Drivers directory 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Sets desktop wallpaper using registry 2 TTPs 2 IoCs
    ransomware
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies Control Panel 4 IoCs
    defense_evasion
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-01_3ee2863657f302a461fb40cb8770aa88_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-01_3ee2863657f302a461fb40cb8770aa88_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:6020
  • C:\Users\Admin\AppData\Local\Temp\2026-08-01_3ee2863657f302a461fb40cb8770aa88_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
    C:\Users\Admin\AppData\Local\Temp/2026-08-01_3ee2863657f302a461fb40cb8770aa88_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:1432

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        AppVShNotify.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
        • Size 9.5MB
        • SHA256 0785ad2790f35f060ca7639704403e4f4c51c919392fee4b7a73fb44c56dc444
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        InspectorOfficeGadget.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
        • Size 18.4MB
        • SHA256 848af8cf50396b39a0c7fb6724d1f72a97ccbf6e41472c874a77d1d1ab008e44
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        IntegratedOffice.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
        • Size 22.5MB
        • SHA256 9d1638a639540cad3414bad43eb186a02d8169ee14f57c5f0cb42a975c045fa8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MavInject32.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
        • Size 18.7MB
        • SHA256 67d27a478322d199aa94e4476da6c5e66ab463ac31fb32b49764b87afe7dd25d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        OfficeC2RClient.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
        • Size 41.8MB
        • SHA256 c46f3ff692f71485c196dd6467357bf05b4fac03ab7ca0b73c7f6305583e86bb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appvcleaner.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
        • Size 11.3MB
        • SHA256 9ffeab200900c2ab60b1310f6b5e18cecdaa98ab1a8050a7df15decbe688d0dc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VSTOInstaller.exe
        • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
        • Size 18.5MB
        • SHA256 4ca53c6ed86020b6c09f7bda8a851386df7b0dbc6c33049c848ba45adba3b17b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        setup.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
        • Size 24.4MB
        • SHA256 36f0cd3f9390481dc75523a77b9bb94d7cbf3de0e17f0fac3e752db7f101cc32
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_pwa_launcher.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 20.1MB
        • SHA256 36ce40e04d422e4a9d7b4a94bc21789f2cf80c1b12eb51c2cac2964afd3ea4dd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevated_tracing_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 21.8MB
        • SHA256 3261d703127c69a69bbeb498764c7bcc6f93b3262253baf7a59b092d4946ad6b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 20.6MB
        • SHA256 a29099e4d8efb7d309a1df19dac0b017dfb6ce4859d242b87195c9e5f58fd3e3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notification_helper.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 20.0MB
        • SHA256 9b24a60f39711ec3fbafef297f167cb693964e603cc86f046caecadbebca34f2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 21.4MB
        • SHA256 ac1e764552baf66b6de2e1a8aa8292b80d5e5071405deb310411958fe1f21021
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_proxy.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 19.8MB
        • SHA256 f5e89cf62c2c29f0bbe9ab835a6874230a2f44bb6a38ba764121cd1d3bdf22ed
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 18.4MB
        • SHA256 3603ec3967e529ab624e92e986743ee0a94d306f29abf6e65d38222e50d797fa
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 18.4MB
        • SHA256 a20b04ebf9c16bcff726d3b4ac24e1485d04b29babaf7d9d73bcda39a9ba7caf
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 18.4MB
        • SHA256 28dc2657b260c9efb0b4d0a76d35033085c8695db7cdd54fd72d749ac4682a88
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 18.4MB
        • SHA256 1ef85037b66e76f220d6b21794209dab11decf1d23f8cab97fd5f7a7e0941e4f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jar.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 18.4MB
        • SHA256 31cb53a654c8d7b58a266921a5ff6b026dc862e55f623e536073477feff97c8e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jarsigner.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        • Size 18.4MB
        • SHA256 4006a957ce63e0218c70708520e65db4078482e102ea843e74fb56f92e3f0dad
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 18.4MB
        • SHA256 8bf916a31519fd4805468f2af807844327b7d8c340497cbc6fc4f30291abf699
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
        • Size 18.7MB
        • SHA256 5fe92ba9b286ec44e8ad6895d999b01e82569cb3eebf7bc80e3aff9c380159a0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javac.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
        • Size 18.4MB
        • SHA256 19c0e1aeb52980d3bde981c9360e1213e1794608d9807ff6ac75835049bdac80
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javadoc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
        • Size 18.4MB
        • SHA256 61da496a22d276ed12efba0661eb28f56143efff6c2424d418873a0ef2f36e63
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javafxpackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
        • Size 18.5MB
        • SHA256 6061e4a30033c4f1b922f22e2490fc0a4c4c979bf6a05749ba8c6e48a80a9d1e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javah.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
        • Size 18.4MB
        • SHA256 6e847f1e2fd54b9d4c27fd4a0b25b459149d46cd783236717235bfc3578fd408
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
        • Size 18.4MB
        • SHA256 4988edc1c8fd82fce1ad45f1edc1d205d69d50f2bbeb8b1e93e40c5f58ff7229
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javapackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
        • Size 18.5MB
        • SHA256 d8e07ab2155d07370100533a7f1cae1e099b137b105e3729e496e315b19542ad
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaw.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
        • Size 18.7MB
        • SHA256 a85f921de1951f15584e923c54122bb3b683d2137375b5e7dbb2057a8c421609
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
        • Size 18.8MB
        • SHA256 9e2265b0e1ff47a07a8b1ac3d8480f7df57fbfcebac79159a1d2f2181cab92c0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jcmd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
        • Size 18.4MB
        • SHA256 f3dd5f32250ac9aae4c4aba98976f5f88c901301e219729e1e9335904a87d5bd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jconsole.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
        • Size 18.4MB
        • SHA256 12aa4b15212f2f3d75735e6140be6af92b8cd6fd0a0770c43fd38f5a46fce794
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdeps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
        • Size 18.4MB
        • SHA256 ac47f76c9585640464d5f390eb4e403e0f680a2dd856191d028117be3d2c2562
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jhat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
        • Size 18.4MB
        • SHA256 0cd9de03d44ea9f932fdfaf3e1985b02af4b9f7cfde16301fd44bbfd11d4d52f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jinfo.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
        • Size 18.4MB
        • SHA256 71a9cd6dd54f8cc063ee5693d5658d2d845e384bfc61208ebe661b34c819157c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jjs.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
        • Size 18.4MB
        • SHA256 1088f84777cb025d5f1a6549e9b1629e179bcb9b10261efa4c2f2c68e88051c7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jmap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
        • Size 18.4MB
        • SHA256 8da0f3a9a96c16a1e17f5a3dadcd1ea5fea48786444c0057a71e640a40d49eee
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
        • Size 18.4MB
        • SHA256 a5724d7c5ed88fbe874d57052eedf1c833b456a6ad2a5edc4602f38fb3ad54f7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jrunscript.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
        • Size 18.4MB
        • SHA256 d554be513c8c10ecc37e1b29de77e487d74e91fa6c9824eea47c87ec16a64bc5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jsadebugd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
        • Size 18.4MB
        • SHA256 238972e0a1e004227bc5bec58ca7cba199566544db551c8dbbac06568d212df9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstack.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
        • Size 18.4MB
        • SHA256 2e23971e3390bce4ab96ece806027e74cebb82867e18acee27195308be31bc7c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
        • Size 18.4MB
        • SHA256 3f893f3a27416e151c57cb441fea2a2d36cf89ea97451058dbe1d668e123f258
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstatd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
        • Size 18.4MB
        • SHA256 dd9ac59aaa44e9aedeefb2492c556f4b3041ac9755cdbf5758ecc81dcf907d0d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        keytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
        • Size 18.4MB
        • SHA256 48081527ed1e5303aee80aecfdf89ea2f4a71425a42bde3acc6f8d3827e79f35
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        kinit.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
        • Size 18.4MB
        • SHA256 5f36e1d805d3263c38d75ed949d48fa941aacea059bf5be877b68dcf051b3d66
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        klist.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
        • Size 18.4MB
        • SHA256 87b269a1e0e6dfaa20a7ea24a6d478372e9603b6fb5df5d7f46ee2411e0a7111
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ktab.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
        • Size 18.4MB
        • SHA256 5ddb9dee49926f1a9edaf234682d9fdf5007da065bc6652f585851bff925b19b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        native2ascii.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
        • Size 18.4MB
        • SHA256 3f21f139fbe00fc109186e09683d112ce933c72182cf2f1cf58f65ddad3874e1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        orbd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
        • Size 18.4MB
        • SHA256 5344576601092c2b355893161fd56fc867a7cf873012d7b3bed8c4b7833f9543
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        policytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
        • Size 18.4MB
        • SHA256 23bf5e1e101c4ce630a617cc89d63d0422186ff95144986942db06a27fa744f9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmic.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
        • Size 18.4MB
        • SHA256 777419ff5d58474993dde9c7a275c55e22829c0049cf9de134b8bfa726560e90
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmid.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
        • Size 18.4MB
        • SHA256 b898dab124bca6cf57cf3cff578e588f8c1ffb05a634a82d868cfe4e38588c58
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmiregistry.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
        • Size 18.4MB
        • SHA256 edcb89820f0d67c53fb9263451bc61a47c72eae210d675cf5fc4e496649bbe66
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        schemagen.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
        • Size 18.4MB
        • SHA256 805a884d4d301b068701fa54d06c07f4b360c329be9374eb47dca2f7a099261c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        serialver.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
        • Size 18.4MB
        • SHA256 32a00d3d53eccabb65f9eceba9084ee01a3f12f079a4b1758f6b3939e81ff78d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        servertool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
        • Size 18.4MB
        • SHA256 d07bed5cc92cb1a4fa6576a3eb6110421b16e4620ef12f68550e39ea8ac429e6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        tnameserv.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
        • Size 18.4MB
        • SHA256 d2e73af413f8eb875d5c77156c4b5eca96a8652b96149cac519b07851459228b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dotnet.exe
        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 18.5MB
        • SHA256 16a0d6a4990df1356f803522774939a20e813a54c98efe86da60000f6455e722
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 18.4MB
        • SHA256 ee5b57feb4ec3ef3561137358c6db54bc782289b434fd2f0cc1fee5535f82b7c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 18.4MB
        • SHA256 aa774b71fa0361990faf86f668ee5c1d95ca9c085f0acb2cc8e89df815ed2995
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 18.4MB
        • SHA256 ddcbb9aea3cbb47273295fef6b91a8af8dea7ea6a740d6bf18db4bc71a32d7d5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/1432-21-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download

        memory/6020-0-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download

        memory/6020-1-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download