Overview

overview

8

Static

static

3

2026-08-03...ar.exe

windows10-2004-x64

8

2026-08-03...ar.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    143s
  • max time network
    155s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    04/08/2026, 13:10

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-03_0889183c9f93e62c5b0511364e9cbf96_cobalt-strike_elex_emotet_glassworm_icedid_njrat_remcos_vidar.exe
  • Size 39.2MB
  • Sample260804-qeqe3afl81
  • SHA256 51aead5da9fe8e73232c755b0a177db339a69fc4c1976cafca946b73926c927d
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
defense_evasiondiscoverypersistenceransomware

Malware Config

Signatures

  • Drops file in Drivers directory 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Sets desktop wallpaper using registry 2 TTPs 1 IoCs
    ransomware
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies Control Panel 2 IoCs
    defense_evasion
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-03_0889183c9f93e62c5b0511364e9cbf96_cobalt-strike_elex_emotet_glassworm_icedid_njrat_remcos_vidar.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-03_0889183c9f93e62c5b0511364e9cbf96_cobalt-strike_elex_emotet_glassworm_icedid_njrat_remcos_vidar.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:1344
  • C:\Users\Admin\AppData\Local\Temp\2026-08-03_0889183c9f93e62c5b0511364e9cbf96_cobalt-strike_elex_emotet_glassworm_icedid_njrat_remcos_vidar.exe
    C:\Users\Admin\AppData\Local\Temp/2026-08-03_0889183c9f93e62c5b0511364e9cbf96_cobalt-strike_elex_emotet_glassworm_icedid_njrat_remcos_vidar.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:4364

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        AppVShNotify.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
        • Size 37.8MB
        • SHA256 036a0306b7ff7409c740897b978bb0da6d815b6c20a23453ed62e52b40b8f151
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        InspectorOfficeGadget.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
        • Size 38.0MB
        • SHA256 1a2fc4e0c4907a1abe86a665e9268c0d7b191f8e294f23b4f19faaf38c50a5f2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        IntegratedOffice.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
        • Size 36.8MB
        • SHA256 0aa773b89645e4c60451b160818f51b6ba8021373d04dfc302fc28a1e92a46ae
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MavInject32.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
        • Size 35.4MB
        • SHA256 02c0ffaebb16a0854550175e12d3fc35fad560853942a97434900cc8b56ec29b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appvcleaner.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
        • Size 39.7MB
        • SHA256 330523e3dffd5f140b8b0032096762156183887c82abf315bb0698287839df35
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VSTOInstaller.exe
        • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
        • Size 33.0MB
        • SHA256 1a8a904f4fea3696413cc943f0edfbd61395914679169fc6c27a7bc8fa574b3b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrmstp.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        • Size 29.2MB
        • SHA256 bcfbd2d4e6fe3fbc2653fdc1c5e310ff8d2b98db757610e9d677e951c0af3070
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        setup.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
        • Size 27.5MB
        • SHA256 ba3c72ed6f264872a065e8ffd2ad980b3b2a32b358c064a06b801b15ca6a4476
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_pwa_launcher.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 29.6MB
        • SHA256 60349f8cf2c84b7a3203b5b8fb32abe874fde738b9b35585cc9e14137b0d74a8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevated_tracing_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 28.6MB
        • SHA256 b6eada23df7af502ed698fab495111a921cb8b1d161431ceda067f3e99646732
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 28.9MB
        • SHA256 23ba91aa133029a0ad886c8987def89b3e6bd33f2b070fbb65b32cd0ec44278f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notification_helper.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 25.9MB
        • SHA256 9bf44626d6166a0e6c4a0be8e7e0ecccf487af0778bcc91371037d552ab58d18
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        os_update_handler.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 26.9MB
        • SHA256 c4f655282a2b2e9125bfb2d4afcc95cc62682ae80c6b51116350e4afb712f876
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 25.0MB
        • SHA256 cb3738b0a201741dd19771338f188b7edb2945ce60b31f3272475932cbe00fe0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_proxy.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 26.6MB
        • SHA256 2a0644820c9dd47acd3011265b4dd9a62ce34767623c388282be19bc691c7666
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 26.8MB
        • SHA256 297e7e34e2a64a8fa210af2ee4bc8556a61f489cd7675048e590f2bf323c037e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 25.3MB
        • SHA256 ce1b7465fdbc9bbdb1e7d85850850f497f83ab91c56dbc7fbad7253f69926707
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 24.6MB
        • SHA256 1b8928e4c76feef01df42ebd97b30fdff845df4867c1b10330583881065ffdb7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 23.8MB
        • SHA256 20ee7336fb98cdf12f311c2cf56f3056832cd2f3ec096081aedb9f9930f82353
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jar.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 256KB
        • SHA256 6adff2403606f3fae51ba272308ce91c8124c63f116c3d886a5a38b4ccbce497
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jarsigner.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        • Size 23.8MB
        • SHA256 eeaa1d405520d7ecf35d22a2ce415d7ec45ad3afec78c4de5807b91604ec8db6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 25.0MB
        • SHA256 f2c719ab3f4a7bfd71f89d6aa3b669a52e1ac93e791c4225bd7c706ff96aeb1f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
        • Size 24.2MB
        • SHA256 441baa504ab1270e8a4ae074356525b0982dad4d36cc5d2a716b9d2e317e7ec2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javac.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
        • Size 23.5MB
        • SHA256 3229423c31dc87a963e80e84edc68aff3a28fe41dad6f651f6ba6a7c6c2a8382
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javadoc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
        • Size 23.9MB
        • SHA256 ebac2626f9b3808f83446ed300316bf4110f0b353f3805f8a743fe795dd5de5b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javafxpackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
        • Size 22.2MB
        • SHA256 61a259ce1688fc58eee523042fa5f41d5988967a18233e446f2a26265181fb8c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javah.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
        • Size 22.7MB
        • SHA256 01ddb9dfff8af4b78704a087259e8fe50c61debe173271601120aa5a093f2f7f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
        • Size 22.2MB
        • SHA256 95ed83f73eba2a3087647af2e60e379c656e78edbaa673948ef2bb27c12d9588
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javapackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
        • Size 22.5MB
        • SHA256 481f4f6222719aae93b3e6bc61c373cae96936b6013381d65580902b87717d56
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaw.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
        • Size 21.7MB
        • SHA256 44d3fe13693d162eef2d0ceb77c74131ca51b4390a8bab034dc2bd336a1ab26e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
        • Size 21.6MB
        • SHA256 1dcb047876ab99eccaca55f8a2d70af0249e49010fdb1eaf9f4dd9186c12e8c4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jcmd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
        • Size 20.9MB
        • SHA256 3207c866bbcad14c46eaa8d5e09b586878e71153e9bb365cbf04a65e20de3814
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jconsole.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
        • Size 19.7MB
        • SHA256 5f1b29f0940f63782647229eff4411e8130cb0e0d341baf69194b90faf5d250b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdb.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
        • Size 22.9MB
        • SHA256 37cb190a0a600fa3c43aceddeacd3ab2f6e09675c3ed11e09d2787484d17854c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdeps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
        • Size 21.2MB
        • SHA256 d4defa1963f206520a6ce560d2a783ce5356962b9a4c675af2c387f6ecc221f7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jhat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
        • Size 21.5MB
        • SHA256 9679750f70b3d47419378e26c11830a27d8bfb970f117d2ec19bc21b5e8e9cff
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jinfo.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
        • Size 20.7MB
        • SHA256 0db654ebdc8f95018c0b44aee677094cae7b2defbcb285cb639bc067498bff34
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jjs.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
        • Size 20.2MB
        • SHA256 2dc41a49091ed398150cc030076985ba84722736bf55df9ec5765e00b3b504c7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jmap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
        • Size 19.6MB
        • SHA256 5a99693f6e74e4c0db9872306586d8086310ead6db1312a412d5305eaaf62c36
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
        • Size 20.3MB
        • SHA256 271ca6f928c7e56d4939fc5feb2411a968896c39e2498642250e6f66b75f3224
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jrunscript.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
        • Size 19.1MB
        • SHA256 8035fcbccefad15c634f06da13485ddbb91134740850010761eb73c12fc1d7eb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jsadebugd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
        • Size 18.8MB
        • SHA256 fbfd8abe62a5db01441e409dbfced4f661192b88e2da12b8b3d94280704c5863
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstack.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
        • Size 19.8MB
        • SHA256 d2140230ee0bcc050b1a61afa3bd530366360068cfcfb14d8cd1fbf56596495d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstatd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
        • Size 19.9MB
        • SHA256 4051744c7538832de4a3a529725e89dae7f5aee70f7dbdb540968ad876bf4174
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        keytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
        • Size 18.8MB
        • SHA256 fd653c54dacbb6ec71b6e0f8cf16a8eb18a4ccee241bb65097f498304b350d96
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        kinit.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
        • Size 19.1MB
        • SHA256 c6348bff6faf370f4cdea0440fa706dc0b9a090870a9cb540be9620711260711
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        klist.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
        • Size 18.3MB
        • SHA256 cd890d0e0956a691538b6cf8fb2c9264b102cca01e3127aa02f1bbe28f7744c4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ktab.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
        • Size 19.0MB
        • SHA256 eb0203953ba9e5f035bc6a4ace82824ba08a8803a1914a3b69f24896f4514e5e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        native2ascii.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
        • Size 19.0MB
        • SHA256 9b53aabc0485c016b23e4c4c4feaea782954f5867e77f7a198bee57a3900e9cd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        orbd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
        • Size 19.0MB
        • SHA256 7304b6739bd16a7c78b85239c571aa1a1f7d7bc6b0488bfe89377bf03438bfb3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
        • Size 18.5MB
        • SHA256 bd6c5b7cf8f125db84040b0661d3a30119fda0475ba25f5746ba82313fa84b5a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        policytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
        • Size 19.0MB
        • SHA256 6ed941fd39919d154310a83b5561b58fbd4f005beebd99f0f1f2b6c9b8736ad5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmic.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
        • Size 16.8MB
        • SHA256 581741843def4755cd8efcdc477c116d9307eb49df6e59715793d9ed78813603
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmid.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
        • Size 18.4MB
        • SHA256 f0bc704fc59f702b4f1a7d042ad46148fd984578760b2486f144cc3122cc456c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmiregistry.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
        • Size 18.9MB
        • SHA256 efb1bd3af9173c985c3a30c1ee078de4baa8cc5bfbde002e22996f528cc3b96a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        schemagen.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
        • Size 17.5MB
        • SHA256 cc449a00ebb6df52fc1955b41376d439065299d036057b6ab61d419994e9aef3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        serialver.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
        • Size 18.9MB
        • SHA256 4ab1ffe12f0858edcffe4a3784f5fe4f91ce80ad60d2e9cbfa3f5eb0d0774ed4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        servertool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
        • Size 18.5MB
        • SHA256 94e510bee9935ed65afd6cbd0c3a99b231f16424869f6e525588cb018aaa1e51
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        tnameserv.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
        • Size 17.3MB
        • SHA256 6df44c8d67c2dbbc71be1e4db28c80a36b54487c05ec5864b397617d42031d99
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dotnet.exe
        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 32.0MB
        • SHA256 d80be4ace7b0d9c8974f2718c08b3609fb2e3ee67c2d1d8f4a6cd1fcb78795d0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 31.9MB
        • SHA256 9a9c4e63d56fdd17b831b4ae28aaf33e19bf96fc194b21f2f8a49e201d19e20b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 29.4MB
        • SHA256 938160993134203cb1fb720492772d2381159807f73bc2c5a005b25f02101c7a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 512KB
        • SHA256 fded04c6d782f8085d397cfe282605c1f1fba531c6920ee79072db343ae14316
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download