Overview

overview

8

Static

static

3

2026-08-02...ar.exe

windows10-2004-x64

8

2026-08-02...ar.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    150s
  • max time network
    139s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    02/08/2026, 17:44

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-02_8c73c9b63eaea638809acd45963d175f_cobalt-strike_elex_emotet_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe
  • Size 4.5MB
  • Sample260802-wbas4ayand
  • SHA256 daeffd1b67ad5894d1d7823504c4c7cb010362431cea0050955d85766c1134bd
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
defense_evasiondiscoverypersistenceransomware

Malware Config

Signatures

  • Drops file in Drivers directory 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Sets desktop wallpaper using registry 2 TTPs 2 IoCs
    ransomware
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies Control Panel 4 IoCs
    defense_evasion
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-02_8c73c9b63eaea638809acd45963d175f_cobalt-strike_elex_emotet_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-02_8c73c9b63eaea638809acd45963d175f_cobalt-strike_elex_emotet_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:5296
  • C:\Users\Admin\AppData\Local\Temp\2026-08-02_8c73c9b63eaea638809acd45963d175f_cobalt-strike_elex_emotet_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe
    C:\Users\Admin\AppData\Local\Temp/2026-08-02_8c73c9b63eaea638809acd45963d175f_cobalt-strike_elex_emotet_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:4584

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        7z.exe
        • Path C:\Program Files\7-Zip\7z.exe
        • Size 5.1MB
        • SHA256 059afaded7e0e48a8f219f39e7b1441aa181574915753d56129757b6046db622
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        7zFM.exe
        • Path C:\Program Files\7-Zip\7zFM.exe
        • Size 5.5MB
        • SHA256 725dea6d5ae38865bbc97981828c59d1c3b0531325abc3efa8da4d7495f8ea1b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        7zG.exe
        • Path C:\Program Files\7-Zip\7zG.exe
        • Size 5.2MB
        • SHA256 81d24d80f202d747e0623c72c73e71adf402ce7dad43aca9b0fece385cbb9ef7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Uninstall.exe
        • Path C:\Program Files\7-Zip\Uninstall.exe
        • Size 9.1MB
        • SHA256 c46f4c932a540730913eb3cc9697d24e085a57fae5825f797b12ef526319ffcb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        AppVShNotify.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
        • Size 9.4MB
        • SHA256 3ba649a64bc1032d7544ced0f000178b8c156ca5b17dbb30c3a532b93900f2c0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        InspectorOfficeGadget.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
        • Size 9.1MB
        • SHA256 6dd1e00b85f1c89757a2acab1d66b19a4f90f6cc889dcc4246046549fd9f7894
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        IntegratedOffice.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
        • Size 13.2MB
        • SHA256 6ffd7068d1db0af495066673dba425084a3529c15eb8c640a46e8fb1153059db
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MavInject32.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
        • Size 9.4MB
        • SHA256 9648eac94735d1056cbde5e1d889ef916d2f4241d91829bb6f0922e3ee3813ea
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appvcleaner.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
        • Size 11.2MB
        • SHA256 8dc097964df3098c399745dd42598fd8eae594dc8ed4ecdaf5ef9d3a46f2abdf
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VSTOInstaller.exe
        • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
        • Size 9.2MB
        • SHA256 81d6cd92279ff55e070c16d629da9a1a44537219daa9ded7ef251b803af0b518
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrmstp.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        • Size 15.2MB
        • SHA256 0794bf885964a85a0dbaeb98d293a04dfbc8c32e7662dcab6abd076edff920b4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_pwa_launcher.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 10.8MB
        • SHA256 c6fc06fc11e6a85ce2026dcda8162371a801d693cdfa21486cbe1316bfaf64ac
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevated_tracing_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 12.6MB
        • SHA256 c652c607a5cc6c9bad482f7cf24cf23df1c4825e825fa381ece6f043162fe42e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 11.4MB
        • SHA256 ce6be9de55a115aff95f03f68935a77c401f6102243fce5c768131cad493385e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notification_helper.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 10.7MB
        • SHA256 129446247aa4d2ad88742fc43b39e3ca8de07c7709aea515c24661d87341726c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        os_update_handler.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 10.9MB
        • SHA256 455bae9558260cace0965dfcb2504e19327b8d143449b0ef86fdc9e4fda0fe3c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 12.2MB
        • SHA256 0c6ec114e4ca27eacb8911f1fa1da77919b73e51c3de2bd26a4a52eefd32b5c3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_proxy.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 10.5MB
        • SHA256 62d73a451f6f6d39050082691c34b261ba2db6b8c2db05b81152ffe011ff12a4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 9.1MB
        • SHA256 8cf634133806166b2c3b61b505549e122af2b6e0c5ad9ad4eb5d782866e07ccd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 9.1MB
        • SHA256 d8328ab92fff5603902f621e88a8a08b699da19a68d46e6e9c8892a199e92588
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 9.1MB
        • SHA256 afb13ee5fc26c192af85d06e806caf803b74dcb285c3819b0bf9a564df67cdbe
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 9.1MB
        • SHA256 391ede6a23ef88009da01c49df4e5199b1862e6b6f9c9c5a66b28d1b649d7385
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jar.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 9.1MB
        • SHA256 ae531578105e005257b61396202851c7054d3650736e97c318880327550205c9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jarsigner.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        • Size 9.1MB
        • SHA256 d7df90c755239439c9b1eec14b07eab76105bdb9d5afca173795c80ccea105bb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 9.1MB
        • SHA256 182aabbf6d059e6aeb610d6dc1401a3490474e171838db0e8264c5ce9b3b02c3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
        • Size 9.4MB
        • SHA256 1c6e108493cf32179c0ab9a50d9e7e428b870a52dfe71f64ff79c70294a7ecb8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javac.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
        • Size 9.1MB
        • SHA256 5cdcfb1bf912fb7ca4051c6781188765d72ab3ab81fe1f73eabf078f00bc6ee7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javadoc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
        • Size 9.1MB
        • SHA256 f670d76822b71bec1bb5358608a3da8cc542598dcc033417fe6a48a7aa874a57
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javafxpackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
        • Size 9.3MB
        • SHA256 72a822585bb7f64c7eb21576a9fbdafc4ee5e103166f76b1506f5652c58f4287
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javah.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
        • Size 9.1MB
        • SHA256 dbc9ac9e46c27055a36cfac8e649ea747ba6361de8da40c3e72c9396697c025a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
        • Size 9.1MB
        • SHA256 7b6ef0a60d78f243692f098c8dc2fb6ffb6734757ae79b9231d160b594893cf4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javapackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
        • Size 9.3MB
        • SHA256 d27449a25716f9d2297ba223358bdbafb90f3461d4ba0222467b80b980ba1b90
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaw.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
        • Size 9.4MB
        • SHA256 35109e8c9f1c560255ed5505f9aa1eaf9f4124827e8ddc3a825e340dc95d3612
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
        • Size 9.5MB
        • SHA256 9c34761f757e9704bc31b35ca1d1d9a3d0a4f9e7717ccb2fa344badaf4fe4088
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jcmd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
        • Size 9.1MB
        • SHA256 ebe660e900a88c1554e6a7a84c467e72bf3a7f07e200a83352f92e09994a2f60
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jconsole.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
        • Size 9.1MB
        • SHA256 b6c3c1cb0f9d956a511c005bf074a7dcc301e3ecabada4f97a97034c4446ef31
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdb.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
        • Size 9.1MB
        • SHA256 ea537efca4aa840bb962fe4d62f70ba09a7d29a1e4b3a9a87057b2e61965d6e5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdeps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
        • Size 9.1MB
        • SHA256 cf9ae540920f0c026f5ce153a302ae77f64131b897e50c73655e00bbac193ec1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jhat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
        • Size 9.1MB
        • SHA256 932374551f1d9dd4f05f62ef98a0c9c5dcc4e1d87d0419f87d931c1e1713fbb1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jinfo.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
        • Size 9.1MB
        • SHA256 09d6701f9b8b5f9abda0fb0f861454d7e3df002b81d46b8c80af9cfb307a62aa
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jjs.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
        • Size 9.1MB
        • SHA256 70fda7d73d9d06fd86744651c53f96757196476996c926a7490320f382fc58bd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jmap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
        • Size 9.1MB
        • SHA256 1f4a9c840e394c28a66f8dd482fbdfe7287ddca668b51d752e0436ccac46ac58
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
        • Size 9.1MB
        • SHA256 92fc0bbece855c737d7df117ebcd31f134e202aa82e52f236cd1140d2261e296
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jrunscript.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
        • Size 9.1MB
        • SHA256 54ce4553cf5ad563dbebd7881f3f4b3a2632567fe2bcde4253819d9940b3b3ef
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jsadebugd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
        • Size 9.1MB
        • SHA256 722b4c7ff67f86d48b97add406077d34546d4d33dfb697f49badbd3fe1aeb317
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstack.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
        • Size 9.1MB
        • SHA256 2d7991c0bccd177c5e62ec38c994d35c9201617d910fe6651791be91bb90228e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
        • Size 9.1MB
        • SHA256 2b9ff4da94a9ec69d12341529bc4e9da0723205411404422cb5148c3f0fe7400
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstatd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
        • Size 9.1MB
        • SHA256 5cb16d078f0d67cfb23213b3ab16cf57882aa426cd16d71fa79f0451cb7f17fd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        keytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
        • Size 9.1MB
        • SHA256 2417dacec23a71e674b05ac1cec9edbb0bff2053ec8e7dc3f3b4af61160ea849
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        kinit.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
        • Size 9.1MB
        • SHA256 c1f7abded111d5ab6a029a397f252688b29385dc7d84998a5ff9735f4ec14b74
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        klist.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
        • Size 9.1MB
        • SHA256 608d55e1f876c66c8719bcdd8760af2fb4dd648d181a73db58c704e20c846e9b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ktab.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
        • Size 9.1MB
        • SHA256 abc9c5084254550fcbd11786393c3f6aea1306b2fe349c2a0fb59f4a42947491
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        native2ascii.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
        • Size 9.1MB
        • SHA256 f7108fc1bdc55d4d86430ca4ea2bca5be6921178286a7745ee13bde716a47dec
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        orbd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
        • Size 9.1MB
        • SHA256 ec4101eaa9b5b503c769b87d39504a2d98824a4596841221afad7214e0a2cd4a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
        • Size 9.1MB
        • SHA256 4047c1810748c93e22a6331f75f6461f98a3cde2b98baa22a4c3b94ab6404af0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        policytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
        • Size 9.1MB
        • SHA256 8b374c7090abf4069c6b1d0c4d9ef0ed4e137d56c1e60481940f01b80453a92b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmic.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
        • Size 9.1MB
        • SHA256 c9317738fabca55ed6773556cb99bb419f48468f94f8a9029a8f3dc6dc269f80
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmid.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
        • Size 9.1MB
        • SHA256 69ad744bf512089fb20741c453c578b4986000d9ffc7b06ea4eb168b10309465
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dotnet.exe
        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 9.2MB
        • SHA256 01853eb327de3a2b612b546e5751f6a93c73671df84db62f98c77b4b9b442dbc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 9.1MB
        • SHA256 dd9b489e924337ca8c5d33c175f67234b454f34cabca468a0664b8674798741a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 9.2MB
        • SHA256 576e1a2f06ece774d8f3a24ab9f30494b509554eec0f5eb0231cf74d1cdb1c7e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 9.2MB
        • SHA256 1fe5eded33435c44c5f2d09053d0b4c5e06d3132acf71f3651c7f5703e986f69
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download