Overview

overview

8

Static

static

3

2026-08-04...ar.exe

windows10-2004-x64

8

2026-08-04...ar.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    150s
  • max time network
    114s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    04/08/2026, 22:32

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-04_a2102ae8d3d3abfd999db52d7df628c2_elex_emotet_icedid_njrat_remcos_vidar.exe
  • Size 6.2MB
  • Sample260804-2f772sfk3z
  • SHA256 99a6b38b0bc018c0161f5dbce00b60d0f82007d438e44f1b59a34c2ea16a6d72
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
defense_evasiondiscoverypersistenceransomware

Malware Config

Signatures

  • Drops file in Drivers directory 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Sets desktop wallpaper using registry 2 TTPs 2 IoCs
    ransomware
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies Control Panel 4 IoCs
    defense_evasion
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-04_a2102ae8d3d3abfd999db52d7df628c2_elex_emotet_icedid_njrat_remcos_vidar.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-04_a2102ae8d3d3abfd999db52d7df628c2_elex_emotet_icedid_njrat_remcos_vidar.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:5924
  • C:\Users\Admin\AppData\Local\Temp\2026-08-04_a2102ae8d3d3abfd999db52d7df628c2_elex_emotet_icedid_njrat_remcos_vidar.exe
    C:\Users\Admin\AppData\Local\Temp/2026-08-04_a2102ae8d3d3abfd999db52d7df628c2_elex_emotet_icedid_njrat_remcos_vidar.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:5196

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        7z.exe
        • Path C:\Program Files\7-Zip\7z.exe
        • Size 6.7MB
        • SHA256 850a56b6965ea945f98ca85ad1e9d825ba9538181b6cc1903c2b72a19a92ce9c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        7zFM.exe
        • Path C:\Program Files\7-Zip\7zFM.exe
        • Size 6.2MB
        • SHA256 99a6b38b0bc018c0161f5dbce00b60d0f82007d438e44f1b59a34c2ea16a6d72
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        7zG.exe
        • Path C:\Program Files\7-Zip\7zG.exe
        • Size 13.0MB
        • SHA256 b8c91a4272f0289f69cc86c3d6482c42cff7a8a553836cd593e796144723fd9f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Uninstall.exe
        • Path C:\Program Files\7-Zip\Uninstall.exe
        • Size 12.3MB
        • SHA256 4f8d8a23496f2af84fb0862c4c04d448f435842c5bab09f3552757cbf4d733b1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        AppVShNotify.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
        • Size 12.6MB
        • SHA256 8c28a27aaee1fe57760253fe1e3c277d2cce1f152268523a7ab681896d9e818d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        InspectorOfficeGadget.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
        • Size 12.4MB
        • SHA256 82b7ce092aa207a7596c4e5f28a2e825ad078674701889ced287e27527cc7383
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        IntegratedOffice.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
        • Size 16.4MB
        • SHA256 c539c9b088a9be363f78a913f861283e911b17819c6168f85752edda3a5bab62
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MavInject32.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
        • Size 12.7MB
        • SHA256 ebeb644688f937d007e54ef1b0041af9d3513de5568f42871cba410b9b0cee44
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        OfficeC2RClient.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
        • Size 29.6MB
        • SHA256 528cad3b92f83e94728c6676b5ed6836aeeb9fc3d46a9d780c877f6c361e5e4b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appvcleaner.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
        • Size 14.4MB
        • SHA256 8e9b35854c8de56d50502624ba515018dc25e323226b830fd8d89f72a82ddb82
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VSTOInstaller.exe
        • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
        • Size 12.4MB
        • SHA256 cc38f009c1fabdccae9e6da9e21d9092b832009c92b99912d24ce0f1f72e6c9e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrmstp.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        • Size 18.4MB
        • SHA256 5dae4ee1ce2c82f1faf3850ac249c4d7e4d253a3b5dc69b0320254a64fc3ebd7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_pwa_launcher.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 14.0MB
        • SHA256 c09a78ad6a175499f392e58209dcd42c92989bcd3994e29c61c419b57a30dace
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevated_tracing_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 15.8MB
        • SHA256 6e90d75546c1404fa08e1f185c02461fc6914c63f4e08685e313fdab8fc8fe68
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 14.6MB
        • SHA256 edaea45d5424b46a1dfb35cf298f16e00b970d41ebbe5ac44c562aa87d302fd8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notification_helper.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 14.0MB
        • SHA256 7f1f14b95d930ce0da78ec793b7a8d0f611ccc24b6eb8288c4bd5d76c9f19930
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        os_update_handler.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 14.2MB
        • SHA256 ff45b98d3f45cae698630a6b726234198e9325b5dfe3cfc73ae0c4851213cad3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 15.4MB
        • SHA256 632531c92660608d501bdb2d95ee57911662c2c0e5fdf1ea8f81ef1a2a1218ee
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_proxy.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 13.7MB
        • SHA256 646900f59f056ed9457e8a3b2e35665c15977bb86a65b7b248a8edb6a2e2e6b5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 12.3MB
        • SHA256 b51423ea9dfbbc024062f46133a2f6f2b91cfa1de27daf20b237abac437aa058
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 12.3MB
        • SHA256 b1e9b12936800ad555c0d3165bf8cccb248eaa340654890c560f90e4f4c7f71a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 12.3MB
        • SHA256 819cb813ed43a368a2f6d6ada945c57960db2f2ed58e1b343839a69c98c5ca40
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 12.4MB
        • SHA256 296e404bdf98f71f60d5013f1b2c10fc78940c9e929ff4070a3475cc1cd38ee2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jar.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 12.3MB
        • SHA256 76eac427614fc599f5612e07b1b704e12365672fbca94439af6df9acd1a0542e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jarsigner.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        • Size 12.3MB
        • SHA256 bdba7eca9aac49c005717eb87af1a5f59dc0963dbe67dd4469321c6aa16090db
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 12.3MB
        • SHA256 a01763317ac3794b9e35cff916c688a9a7635ca2a0394e1ee859f5249ee6329f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
        • Size 12.6MB
        • SHA256 51849b8e17f6727924c032b44ee9f6b364b91c806d314a3828ee8a8136978c16
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javac.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
        • Size 12.3MB
        • SHA256 75f4524f9e5cd7b1d8411e46ffe36908edd975d269e5d5bf58d3ac6374946388
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javadoc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
        • Size 12.3MB
        • SHA256 eb35fc172f2070c13c671d0d5f36592e1ef563f161a835babbe6df6d63e16fc8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javafxpackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
        • Size 12.5MB
        • SHA256 2022f355d4698ed77d2145ec664289c14c5ea067522f856c8505edcd4cd0eded
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javah.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
        • Size 12.3MB
        • SHA256 270de046faa8d140a07a50087d88326c1c980b97dae18aa36c1f34b00d8017e7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
        • Size 12.3MB
        • SHA256 862ce3721ffdc96f4d34c0a45a73b7a0a9a649c26a00405f187711c012934517
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaw.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
        • Size 12.6MB
        • SHA256 71ce7f02d396c5a983c909dbc774ee3abf5be30883de33afa5d0817521b190ea
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
        • Size 12.8MB
        • SHA256 08559e7828b31233b65b654386da49e7f9815c3c6b2474ad6ad4cfea8063e023
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jcmd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
        • Size 12.3MB
        • SHA256 8fac15d1f4f88e5425d5deb68a99d80e7c75b2ecf0b57f0c454bf007993bb079
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jconsole.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
        • Size 12.3MB
        • SHA256 1ad4bab471a00fc97b03dd87152654622210989325d0bf239879f56206bf7458
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdb.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
        • Size 12.3MB
        • SHA256 f59b1bd4f56ca07deb261ec282bf663ea522d31ba66eaf42e14ab21349fc3d18
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdeps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
        • Size 12.3MB
        • SHA256 7badc468a7571abc3154c4a80e278c4a85b509cbcd1b799ed953a8e1ef50ae7f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jhat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
        • Size 12.3MB
        • SHA256 6fec7c8c64f9237f732af639b406368b550e329125ef687be454041939dbeff9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jinfo.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
        • Size 12.3MB
        • SHA256 bdec4e99e7fb3e018548e6ade3a40f4898ec3c0c925f6c64f0b57ceb4945515c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jjs.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
        • Size 12.3MB
        • SHA256 e46106865c933fdf475b7170b25e87ce059fa8595ccd003c4b16f703dc6bc4f2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jmap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
        • Size 12.3MB
        • SHA256 c97c80059ffeda0b4dcc838548625c08160ba707b27c9dbce8425313e806c442
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
        • Size 12.3MB
        • SHA256 6466f376d0499b80ad8af618eed82f840a905459842a765ecfdf2397dc253c9c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jrunscript.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
        • Size 12.3MB
        • SHA256 73e1867c8a37282e5407c8ba125da0ea81ffe7f776bc096dccaf9f3d8dfd6dfc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jsadebugd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
        • Size 12.3MB
        • SHA256 13380da1496f83f4f26380691add116a7f3f4597f050d7121c041a22190c2b6b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstack.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
        • Size 12.3MB
        • SHA256 b49624abe58358e600dc06bcb245f40a41f2a46e9ce29b7965343532133664a6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
        • Size 12.3MB
        • SHA256 206165e13a1041045c345ba8746bcac5373dfe1b739f1ce294351fad20c59786
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstatd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
        • Size 12.3MB
        • SHA256 7d7363d7a747c4132c4a8f57e86d1a9f9efacf5ef92bd4849fe35cf78e922cf0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        keytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
        • Size 12.3MB
        • SHA256 9cb5adedfb4a756f3cc12e667ba93664c2dd86d70dc97222e8bd6d59b441dcac
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        kinit.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
        • Size 12.3MB
        • SHA256 abf9bcb610e8ce8d4d73e89817885defdab7dc32e2a6da66806a2a9f014d6a17
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        klist.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
        • Size 12.3MB
        • SHA256 f14b9fa291f54d0b74a09954912fa601845051e5355705aabadeb22e99939790
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ktab.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
        • Size 12.3MB
        • SHA256 68bdec33f3783ded4f54b772a94464441ca1d37aa646903dafad706104199caa
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        native2ascii.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
        • Size 12.3MB
        • SHA256 4cb02f8a9f0d8f47b2c299081070b062ebff5bf5f503dfb59be5fa430cb4eee1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        orbd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
        • Size 12.3MB
        • SHA256 372cb69af12e61e24c284c5865e6a2e004a5834b093e32b6c65875e98f76f245
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
        • Size 12.3MB
        • SHA256 14c4995ed257d59b5ed3cf5406c7f09c7fc7bd4a73f96e024dfd6c1c79b43e40
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        policytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
        • Size 12.3MB
        • SHA256 3c2ab28dd64dd111b879dea40e19b70493535b323631ffbaa476acb459e04b77
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmic.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
        • Size 12.3MB
        • SHA256 9c6b976641afef27f3265dfa45131094f57a209e94b133889fa183fb7788460b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmid.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
        • Size 12.3MB
        • SHA256 d694324f1371b0dc77bf664de61fb7927bfe8aed212297a9dc669e24906998c0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dotnet.exe
        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 12.5MB
        • SHA256 cdfe2b3ab6645bc2090b4da20e65eb59b2721861614fa337c619de6d3055e962
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 12.4MB
        • SHA256 ba6b2544ebbd9e9c1e4542abf933cb68cec85321978a7920aa5a104401702ff9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 12.4MB
        • SHA256 ac22456b0a1b1089b961457e38c1d34e0ccd5554b6e82a5b374c5ccdc86c9ddf
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 12.4MB
        • SHA256 8b34c2c2204ff6bd8b829496e334ea80d7cc598413945295f701300da7440b3f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download