Overview

overview

8

Static

static

3

2026-08-02...ar.exe

windows10-2004-x64

8

2026-08-02...ar.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    149s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    02/08/2026, 03:20

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-02_3606bdf0982e71920b92f016c4dd1b76_cobalt-strike_elex_emotet_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe
  • Size 12.3MB
  • Sample260802-dv7ytssvaw
  • SHA256 38e6ef579a99cf63c877c9403b269ffcceea5da308b34046246d9f3d7d150292
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
defense_evasiondiscoverypersistenceransomware

Malware Config

Signatures

  • Drops file in Drivers directory 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Sets desktop wallpaper using registry 2 TTPs 2 IoCs
    ransomware
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies Control Panel 4 IoCs
    defense_evasion
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-02_3606bdf0982e71920b92f016c4dd1b76_cobalt-strike_elex_emotet_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-02_3606bdf0982e71920b92f016c4dd1b76_cobalt-strike_elex_emotet_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:4256
  • C:\Users\Admin\AppData\Local\Temp\2026-08-02_3606bdf0982e71920b92f016c4dd1b76_cobalt-strike_elex_emotet_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe
    C:\Users\Admin\AppData\Local\Temp/2026-08-02_3606bdf0982e71920b92f016c4dd1b76_cobalt-strike_elex_emotet_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:1968

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        ApproveRequest.htm
        • Path C:\Program Files\ApproveRequest.htm
        • Size 12.9MB
        • SHA256 675353982453a1b5d381c0a2ca2cae0345db5fecae746d0c3eed355286a171fa
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        AppVShNotify.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
        • Size 24.8MB
        • SHA256 7494a9eb285f67be67adbcbf39f932a59af394a46345ebf05dd53a47c6e293c9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        InspectorOfficeGadget.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
        • Size 24.6MB
        • SHA256 e871436abe50171f350af404badbe3c087ea6a74d0da410b4e2acde63e544fcd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        IntegratedOffice.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
        • Size 28.6MB
        • SHA256 bd40497e15733bdd6ff5dd1a36ddb2f715df0c18c9b8943f81008cab8f557215
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MavInject32.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
        • Size 24.9MB
        • SHA256 416b6f75a282550dc088c1dc5a533ffc6456bd343e5750b7b49d59436d089e10
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appvcleaner.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
        • Size 12.3MB
        • SHA256 38e6ef579a99cf63c877c9403b269ffcceea5da308b34046246d9f3d7d150292
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VSTOInstaller.exe
        • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
        • Size 24.6MB
        • SHA256 fd64fd836142b2bf96deada1e27fab5275447f5f622824dedc4600cda8ec0e8a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrmstp.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        • Size 30.6MB
        • SHA256 c93aa8c2c452e10fa10a63d896d0040c8467a670b3c908d31fbe35f7ad8f71ad
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_pwa_launcher.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 26.2MB
        • SHA256 127613ff473df8229dea00349622d10d6014dee1a8267d72764111c243c2a7e0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevated_tracing_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 28.0MB
        • SHA256 691bcb2240fbf3ce97106dcdf0436a0ef9b73f21657f6940a7b72abb9652bc46
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 26.8MB
        • SHA256 ef2def2caca97c74c800c3cc4439f7d1ebf125d0d68941af71cde57a95643449
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notification_helper.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 26.2MB
        • SHA256 0aa5382f647032442b08ecc7a0e3c435e41481b7b6812b51d2ebc65f000f790b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 27.6MB
        • SHA256 64b077fa6696b0e26cbda99f14f57821f6892392f390f8b0806ec4404a9f18bd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_proxy.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 26.0MB
        • SHA256 5361f249aeaef73d2bf64a07e77f46871f6a81ca54689dff7f12f49defd0998c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 24.6MB
        • SHA256 a395b82db3e580c045a396bd4ce92c60304db4debb8b3a7f685543b971d9e893
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 24.6MB
        • SHA256 a58acf40d9f30cef2ec6fb7073d20c7c9fb0b6ac8451d47227556c3cd45c28c0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 24.6MB
        • SHA256 a2bacd9c4b461be2bcbe1cfa5e58cd73a4ce0cc85a435c816b434cf096b87509
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 24.6MB
        • SHA256 0a9d59baa253ad38fc9163d1277a1a0936f53234e0bf67e8a990170b046910a2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jar.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 24.6MB
        • SHA256 44ded14f9cb5a948fe62e921044ae529a9854b5826d5d8280b44c8d5964146e9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jarsigner.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        • Size 24.6MB
        • SHA256 7d792a227332311f20ef16949c3e23be6b2989a0981b3e296020abf96631bc36
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 24.6MB
        • SHA256 95ba63aed3af52ab6ec90f82dca0bedfaf70cd97fc6603117cacb76f4d7284a7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
        • Size 24.8MB
        • SHA256 a10035da9d3bacef54d3979d5cc71987e1a1b156d3d99de390c56abcb148029c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javac.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
        • Size 24.6MB
        • SHA256 3c02955581d3a0fce7ca9fd8622c7a9407210d4a9d0d1df405cf032878fd7e17
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javadoc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
        • Size 24.6MB
        • SHA256 c669dde1749a006248209b8d2fc260fd3b98b7c58a282b94e6538d8cbd409c08
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javafxpackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
        • Size 24.7MB
        • SHA256 f370317b5dbfa56fd078e35a29c93f0f0db1d371e60223d978bbca36e9f357b6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javah.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
        • Size 24.6MB
        • SHA256 8712f7bb5bbbd1436c978abe7725bcc315789dab947d08c4875e790a3eb79856
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
        • Size 24.6MB
        • SHA256 5992fc8227636c87a5e86fe78c44f6216c7bc8463a7690335e8c7a02a5eed333
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javapackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
        • Size 24.7MB
        • SHA256 8388252eeae9a1342162fbbff390b43e02c16d8e73bb5d9fce6cae641d5d0bf0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaw.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
        • Size 24.8MB
        • SHA256 27dfb1618d80fa9de134094c48b899cfdcb9a9054e407a2f52069c31b1500343
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
        • Size 25.0MB
        • SHA256 8197f7425a220877a56f808d11325bd7f9c7acb34cd0052721366c8511dc40af
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jcmd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
        • Size 24.6MB
        • SHA256 fdaac0fcc23b4ae74edb602620b89f399809825119dbae2edc78a43b8d4f109b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jconsole.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
        • Size 24.6MB
        • SHA256 61e9937fcdf1b2423c513ead06afe878a42850f392303e3928f6317506a8bfc6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdb.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
        • Size 24.6MB
        • SHA256 e721b23f11142ae8915a88411295dfd12d6a42db57ec67cc3e6a83683d3029be
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdeps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
        • Size 24.6MB
        • SHA256 067d5e46b8974feb510e20712b92280fcf5b868f711d50d12a588e58a4690842
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jhat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
        • Size 24.6MB
        • SHA256 2cfeb8a0c35eed8e870c6407ec16abee4c33f4c2c867a9e1b5a0a06de573eba5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jinfo.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
        • Size 24.6MB
        • SHA256 22022fd448c4b2fab8f426a7a02ba19b0a0f3239f88e39b2761f055ac3c30dbe
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jjs.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
        • Size 24.6MB
        • SHA256 00edfc7655f82d4740f74a5e703656702c1319a6e8c779460d066901a6083873
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jmap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
        • Size 24.6MB
        • SHA256 80ae7d1440c9e67c888362ceea1d43cbcd27a41461f8ca30a7afd37c5cd43df7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
        • Size 24.6MB
        • SHA256 bc06c2ba71a65a6c973d320e228e77f9d4f30066b58a5307431dde58398c5ee6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jrunscript.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
        • Size 24.6MB
        • SHA256 32dbde965770b6662712257022758717cc40b110b8c59a0c53cca0a8926386e4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jsadebugd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
        • Size 24.6MB
        • SHA256 05bd1b0542b6aefd97d9c27492807b4674596d6fbc9c235eda931aa7072cc09d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstack.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
        • Size 24.6MB
        • SHA256 e01cbcd4202346075d0bf930995df850ca458e49f93ff79b9385c3e2976aadb8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
        • Size 24.6MB
        • SHA256 87df3028d1f3e4212c6321ff6ec18eb9f92f7db536efa4f0ba046fa354eeb66f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstatd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
        • Size 24.6MB
        • SHA256 4f208d1699a17d55196b8b92b33e6ccdfbb9981fe1713e7b1c35cc7809d28b1a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        keytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
        • Size 24.6MB
        • SHA256 b6359d10ddbf6a1460bbf0d512b0760bd7ad9e18ae02b1a912b89956b993da1c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        kinit.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
        • Size 24.6MB
        • SHA256 04026521ef943ac8ac7a1e7114a81ef9c5d2788cf1c6f5eb6f3d8597cdd3b5c9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        klist.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
        • Size 24.6MB
        • SHA256 ac892b588226c94faf30c84dd0570cfa6a2eb5d3afa96bfec418f8bce214bb4c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ktab.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
        • Size 24.6MB
        • SHA256 9d4fb1ee46b6ea51fbab0cc683c74ac2447fbd6a07abbb88c64e9125faf6c49e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        native2ascii.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
        • Size 24.6MB
        • SHA256 673fefa89e6f622780da3dd0e5b8b4532d53d2f8f450317c25557e5ad15262fc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        orbd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
        • Size 24.6MB
        • SHA256 90390e883467dba096907444d8fa6de81e441e64f9bb92cad5aa874f9de4b9e8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
        • Size 24.6MB
        • SHA256 667e03b567a3d7150334d025b5bc97513821d0b71af84cb575b05f0b9cec045f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        policytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
        • Size 24.6MB
        • SHA256 c64e9d0fc4c424e604c9e6cb91c160235472102e4659d11348c5f3ca07c1474e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmic.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
        • Size 24.6MB
        • SHA256 9af536d88434dbaa88d7db89fef35ed6e51ef53f3ba2eae33e61e8aa40463f99
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmid.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
        • Size 24.6MB
        • SHA256 38598aaf789fe3029398abc0190b59d23da397e7396e680060fd7daedd2b83f8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmiregistry.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
        • Size 24.6MB
        • SHA256 33e8b12da439700a86ccc40f8ed943c7f3d188d07ccf9fd51b98b615c02b9ce9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        schemagen.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
        • Size 24.6MB
        • SHA256 e884a0b5640122599b62eaf592c21d8b0a5efe1074db16608d3e55ddb142a342
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        serialver.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
        • Size 24.6MB
        • SHA256 f7962c8d463cf4e960c811269eb9aaba47b3f3f7c064c46e5b9fed670037a93c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        servertool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
        • Size 24.6MB
        • SHA256 40e9a45315cba1191b7a39d3890331ef58fb2219e1435aaf442e241325e8ecbf
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        tnameserv.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
        • Size 24.6MB
        • SHA256 45e829e1d071bfd75357a17dbcb27f82dc6b67793e422829424a8415b1b50381
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dotnet.exe
        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 24.7MB
        • SHA256 cc607390c900fbdba943a33b29bb71216693f9efd2aedfe86ffdd68b67c4ba84
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 24.6MB
        • SHA256 97548222e55d2883faf1174af45f2afb633fccd6f097bc106b6b6a16d1008e53
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 24.6MB
        • SHA256 65ea60ddeb1e3c3630db9110050310d3e033f7f5b0a3cc757ce489c59697400d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 24.6MB
        • SHA256 bd8f57ba9abf62fd816db9849830883715726908f3654ac146e906308e3d981d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download