Overview

overview

8

Static

static

3

2026-08-04...ar.exe

windows10-2004-x64

8

2026-08-04...ar.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    149s
  • max time network
    147s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260513-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    04/08/2026, 22:32

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-04_a2102ae8d3d3abfd999db52d7df628c2_elex_emotet_icedid_njrat_remcos_vidar.exe
  • Size 6.2MB
  • Sample260804-2f772sfk3z
  • SHA256 99a6b38b0bc018c0161f5dbce00b60d0f82007d438e44f1b59a34c2ea16a6d72
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
defense_evasiondiscoverypersistenceransomware

Malware Config

Signatures

  • Drops file in Drivers directory 3 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Sets desktop wallpaper using registry 2 TTPs 2 IoCs
    ransomware
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies Control Panel 4 IoCs
    defense_evasion
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-04_a2102ae8d3d3abfd999db52d7df628c2_elex_emotet_icedid_njrat_remcos_vidar.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-04_a2102ae8d3d3abfd999db52d7df628c2_elex_emotet_icedid_njrat_remcos_vidar.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:4628
  • C:\Users\Admin\AppData\Local\Temp\2026-08-04_a2102ae8d3d3abfd999db52d7df628c2_elex_emotet_icedid_njrat_remcos_vidar.exe
    C:\Users\Admin\AppData\Local\Temp/2026-08-04_a2102ae8d3d3abfd999db52d7df628c2_elex_emotet_icedid_njrat_remcos_vidar.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:1976

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        7zG.exe
        • Path C:\Program Files\7-Zip\7zG.exe
        • Size 6.8MB
        • SHA256 74f35659bfd20e15ee66eae8212655616334d094040758b1c9ef7661d7048ca6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Uninstall.exe
        • Path C:\Program Files\7-Zip\Uninstall.exe
        • Size 12.3MB
        • SHA256 4f8d8a23496f2af84fb0862c4c04d448f435842c5bab09f3552757cbf4d733b1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        AddLock.asp
        • Path C:\Program Files\AddLock.asp
        • Size 13.0MB
        • SHA256 f7600f9c98efba25bc0d8d24fdc0732d5a2e3db6cb2e998b3a208d4d4ae883c8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        IntegratedOffice.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
        • Size 10.3MB
        • SHA256 c54d8fe3acbefdacd6f1ef2a1ab09503af98059ca76ad0b044e93f8721feb5c5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MavInject32.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
        • Size 6.5MB
        • SHA256 4af903ff8f305b00ec55dfdfc76d3e7e9dfee049f3dcf92dc6c8d330797080a1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appvcleaner.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
        • Size 14.4MB
        • SHA256 8e9b35854c8de56d50502624ba515018dc25e323226b830fd8d89f72a82ddb82
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VSTOInstaller.exe
        • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
        • Size 6.3MB
        • SHA256 787dce6876f47d6e13e5c0b6307bd43670726fda322398e13fb7422b4dcb833c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 8.4MB
        • SHA256 83f1b10059415630ac10ee54097b07590fcc301e105cdd66f27cc693e8c0055f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notification_helper.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 14.0MB
        • SHA256 7f1f14b95d930ce0da78ec793b7a8d0f611ccc24b6eb8288c4bd5d76c9f19930
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        os_update_handler.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 14.2MB
        • SHA256 ff45b98d3f45cae698630a6b726234198e9325b5dfe3cfc73ae0c4851213cad3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 15.4MB
        • SHA256 632531c92660608d501bdb2d95ee57911662c2c0e5fdf1ea8f81ef1a2a1218ee
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_proxy.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 13.7MB
        • SHA256 99d6fa3df3f003fb378035d69ee83140e10d94d004d4e0b9eb98df2b38d2b297
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 12.3MB
        • SHA256 b51423ea9dfbbc024062f46133a2f6f2b91cfa1de27daf20b237abac437aa058
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 12.3MB
        • SHA256 b1e9b12936800ad555c0d3165bf8cccb248eaa340654890c560f90e4f4c7f71a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 12.3MB
        • SHA256 819cb813ed43a368a2f6d6ada945c57960db2f2ed58e1b343839a69c98c5ca40
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 12.4MB
        • SHA256 296e404bdf98f71f60d5013f1b2c10fc78940c9e929ff4070a3475cc1cd38ee2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jar.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 12.3MB
        • SHA256 76eac427614fc599f5612e07b1b704e12365672fbca94439af6df9acd1a0542e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jarsigner.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        • Size 12.3MB
        • SHA256 bdba7eca9aac49c005717eb87af1a5f59dc0963dbe67dd4469321c6aa16090db
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 12.3MB
        • SHA256 a01763317ac3794b9e35cff916c688a9a7635ca2a0394e1ee859f5249ee6329f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javac.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
        • Size 12.3MB
        • SHA256 75f4524f9e5cd7b1d8411e46ffe36908edd975d269e5d5bf58d3ac6374946388
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javadoc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
        • Size 12.3MB
        • SHA256 eb35fc172f2070c13c671d0d5f36592e1ef563f161a835babbe6df6d63e16fc8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javafxpackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
        • Size 12.5MB
        • SHA256 2022f355d4698ed77d2145ec664289c14c5ea067522f856c8505edcd4cd0eded
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javah.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
        • Size 12.3MB
        • SHA256 270de046faa8d140a07a50087d88326c1c980b97dae18aa36c1f34b00d8017e7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
        • Size 12.3MB
        • SHA256 862ce3721ffdc96f4d34c0a45a73b7a0a9a649c26a00405f187711c012934517
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javapackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
        • Size 12.5MB
        • SHA256 3e0852b648db92b5e5a57140a2297324fb7948474162c3f4a33a97c92a29b1be
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaw.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
        • Size 12.6MB
        • SHA256 71ce7f02d396c5a983c909dbc774ee3abf5be30883de33afa5d0817521b190ea
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
        • Size 12.8MB
        • SHA256 08559e7828b31233b65b654386da49e7f9815c3c6b2474ad6ad4cfea8063e023
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jcmd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
        • Size 12.3MB
        • SHA256 8fac15d1f4f88e5425d5deb68a99d80e7c75b2ecf0b57f0c454bf007993bb079
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jconsole.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
        • Size 12.3MB
        • SHA256 1ad4bab471a00fc97b03dd87152654622210989325d0bf239879f56206bf7458
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdb.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
        • Size 12.3MB
        • SHA256 f59b1bd4f56ca07deb261ec282bf663ea522d31ba66eaf42e14ab21349fc3d18
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdeps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
        • Size 12.3MB
        • SHA256 7badc468a7571abc3154c4a80e278c4a85b509cbcd1b799ed953a8e1ef50ae7f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jhat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
        • Size 12.3MB
        • SHA256 6fec7c8c64f9237f732af639b406368b550e329125ef687be454041939dbeff9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jinfo.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
        • Size 12.3MB
        • SHA256 bdec4e99e7fb3e018548e6ade3a40f4898ec3c0c925f6c64f0b57ceb4945515c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jjs.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
        • Size 12.3MB
        • SHA256 e46106865c933fdf475b7170b25e87ce059fa8595ccd003c4b16f703dc6bc4f2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jmap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
        • Size 12.3MB
        • SHA256 c97c80059ffeda0b4dcc838548625c08160ba707b27c9dbce8425313e806c442
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
        • Size 12.3MB
        • SHA256 6466f376d0499b80ad8af618eed82f840a905459842a765ecfdf2397dc253c9c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jrunscript.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
        • Size 12.3MB
        • SHA256 73e1867c8a37282e5407c8ba125da0ea81ffe7f776bc096dccaf9f3d8dfd6dfc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jsadebugd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
        • Size 12.3MB
        • SHA256 13380da1496f83f4f26380691add116a7f3f4597f050d7121c041a22190c2b6b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstack.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
        • Size 12.3MB
        • SHA256 b49624abe58358e600dc06bcb245f40a41f2a46e9ce29b7965343532133664a6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
        • Size 12.3MB
        • SHA256 206165e13a1041045c345ba8746bcac5373dfe1b739f1ce294351fad20c59786
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstatd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
        • Size 12.3MB
        • SHA256 7d7363d7a747c4132c4a8f57e86d1a9f9efacf5ef92bd4849fe35cf78e922cf0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        keytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
        • Size 12.3MB
        • SHA256 9cb5adedfb4a756f3cc12e667ba93664c2dd86d70dc97222e8bd6d59b441dcac
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        kinit.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
        • Size 12.3MB
        • SHA256 abf9bcb610e8ce8d4d73e89817885defdab7dc32e2a6da66806a2a9f014d6a17
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        klist.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
        • Size 12.3MB
        • SHA256 f14b9fa291f54d0b74a09954912fa601845051e5355705aabadeb22e99939790
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ktab.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
        • Size 12.3MB
        • SHA256 68bdec33f3783ded4f54b772a94464441ca1d37aa646903dafad706104199caa
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        native2ascii.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
        • Size 12.3MB
        • SHA256 4cb02f8a9f0d8f47b2c299081070b062ebff5bf5f503dfb59be5fa430cb4eee1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        orbd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
        • Size 12.3MB
        • SHA256 372cb69af12e61e24c284c5865e6a2e004a5834b093e32b6c65875e98f76f245
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
        • Size 12.3MB
        • SHA256 14c4995ed257d59b5ed3cf5406c7f09c7fc7bd4a73f96e024dfd6c1c79b43e40
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        policytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
        • Size 12.3MB
        • SHA256 3c2ab28dd64dd111b879dea40e19b70493535b323631ffbaa476acb459e04b77
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmic.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
        • Size 12.3MB
        • SHA256 9c6b976641afef27f3265dfa45131094f57a209e94b133889fa183fb7788460b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmid.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
        • Size 12.3MB
        • SHA256 d694324f1371b0dc77bf664de61fb7927bfe8aed212297a9dc669e24906998c0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmiregistry.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
        • Size 12.3MB
        • SHA256 4200e35cbf70f152684f8d96e6ae9db87a88c8c345650e6d83a19da93728fbc1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        schemagen.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
        • Size 12.3MB
        • SHA256 a42323f9842a1f4109cd4eebc1c68a748e09ba0bdcff2400b5c562268ec77c57
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        serialver.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
        • Size 12.3MB
        • SHA256 829bf5da06fe22ba52ca073249bfdcb75ffc8250d4518adf2a57e246f8d6843d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        servertool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
        • Size 12.3MB
        • SHA256 2069f7095e02e40dc2ce4aa0c34511b31c253f7c8971d804ca67743c79c503cc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        tnameserv.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
        • Size 12.3MB
        • SHA256 002eb65a80ca44a775311713aa1105f224994baf80eee789e77368c121978ff2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        unpack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\unpack200.exe
        • Size 12.5MB
        • SHA256 4c005fe32e1fbac25afb6ccc4db12f1456d94631c651b72309f4952290e795d8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dotnet.exe
        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 6.3MB
        • SHA256 9ce575b13af7cac6ecd95199f61f763e6bf5c784ad8524bd3d51b7e203af1add
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 6.2MB
        • SHA256 37f9650acfcc1732e91142ae464b1235b5df1a60380f7beaaaf2ab82af5448f4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 12.4MB
        • SHA256 ac22456b0a1b1089b961457e38c1d34e0ccd5554b6e82a5b374c5ccdc86c9ddf
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        spo0lve.exe
        • Path C:\windows\SysWOW64\drivers\spo0lve.exe
        • Size 6.2MB
        • SHA256 99a6b38b0bc018c0161f5dbce00b60d0f82007d438e44f1b59a34c2ea16a6d72
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download