Overview

overview

8

Static

static

3

2026-08-04...ar.exe

windows10-2004-x64

8

2026-08-04...ar.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    150s
  • max time network
    143s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    04/08/2026, 17:24

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-04_fc15675a8316c554691356e7012e472c_elex_emotet_icedid_njrat_remcos_vidar.exe
  • Size 6.0MB
  • Sample260804-vy1scswcma
  • SHA256 72d1b5c8939ade4a905c2e5d9b4f583848048e742dfa6b51caf0e3fc386c1574
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
defense_evasiondiscoverypersistenceransomware

Malware Config

Signatures

  • Drops file in Drivers directory 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Sets desktop wallpaper using registry 2 TTPs 2 IoCs
    ransomware
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies Control Panel 4 IoCs
    defense_evasion
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-04_fc15675a8316c554691356e7012e472c_elex_emotet_icedid_njrat_remcos_vidar.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-04_fc15675a8316c554691356e7012e472c_elex_emotet_icedid_njrat_remcos_vidar.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:2560
  • C:\Users\Admin\AppData\Local\Temp\2026-08-04_fc15675a8316c554691356e7012e472c_elex_emotet_icedid_njrat_remcos_vidar.exe
    C:\Users\Admin\AppData\Local\Temp/2026-08-04_fc15675a8316c554691356e7012e472c_elex_emotet_icedid_njrat_remcos_vidar.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:3208

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        7zFM.exe
        • Path C:\Program Files\7-Zip\7zFM.exe
        • Size 7.0MB
        • SHA256 0d2b3a6b8c45efac0f0b668371b1e7c3044099f2e5540216f9d51612bfc1b26d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        7zG.exe
        • Path C:\Program Files\7-Zip\7zG.exe
        • Size 6.0MB
        • SHA256 72d1b5c8939ade4a905c2e5d9b4f583848048e742dfa6b51caf0e3fc386c1574
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        InspectorOfficeGadget.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
        • Size 12.1MB
        • SHA256 b9feb7433ea7431f3404c79071aebacda2428e646af90059d520e0d266b1a3d5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        IntegratedOffice.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
        • Size 16.2MB
        • SHA256 5019c0edb1636894cd34ca659cd4ef87ffbd5c4074b777b433755a3cc47ee377
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MavInject32.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
        • Size 12.4MB
        • SHA256 c777f23e5f25ddc918f142a99be3f98271dc4ec54c5a8dce76db35114b50ad27
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        OfficeC2RClient.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
        • Size 35.5MB
        • SHA256 a024c16d846afe157851d1d113d9559c91254fdc0358668c02840333c6a2c689
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appvcleaner.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
        • Size 14.2MB
        • SHA256 c08cf1ae7f71de309816584f075b63e1732a2ea67f5acdab30104e3d198de12a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VSTOInstaller.exe
        • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
        • Size 12.2MB
        • SHA256 7c587d60c968d936e707aea1dca4ea2e255af75fe18797fe4c1e42973685b82f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrmstp.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        • Size 12.1MB
        • SHA256 1edea1351505fd1f4cc0db7a6a87c432f2d9b7680d0ae0fbe52a07bbc58557e2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        setup.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
        • Size 18.1MB
        • SHA256 6bfc5010f3a28ec0bbd6be4ab552bb9a57324268b004cc716235ad7fc7e12969
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_pwa_launcher.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 7.8MB
        • SHA256 511fee7d5c1b637987dcfcd8b3be40b0b97415bb4617bf7551c70f26a408577a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevated_tracing_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 15.5MB
        • SHA256 3bdaac1f27f879c02fe4a55226ef3bb5f5187665af215d934f9f29d9681fc6d2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 14.3MB
        • SHA256 931b492e41664d2a9540bc30e27c501cea67ef64b90bb8bb6525e80407d0d389
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notification_helper.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 13.7MB
        • SHA256 54ab914ac4d1851425071ac6aa7db81a60ab095cb3e0c59c6e27d88b00339859
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        os_update_handler.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 13.9MB
        • SHA256 d7f974ce0badd5cf87521b2b19e9bd12851df48a6fb67a0d055d36bab80f8082
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 15.1MB
        • SHA256 b833743f2fd92b023fd6b62419572dbc7dcbb62f6990e5d3a90baad8d52271fc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_proxy.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 13.5MB
        • SHA256 8597ef166d20f96b1d119d87ff2f44e503446c921c440face85da8bb74a4ed17
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 6.1MB
        • SHA256 0f4b9c78871df212f55e879eb35cd7846c9d163205d8a480d0957847b6008271
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 12.1MB
        • SHA256 3281a4ef74cb2878a565b11ceb18e80977bcaef4f619c4baf578fa95af366b0c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 12.1MB
        • SHA256 a2cb41f4b726cf3be57f2e8dbf5684e5dfd1be63495d1982efcd243d9fe1a194
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 12.1MB
        • SHA256 5ac25fa8a1abf924a8dc1bd9763c6bccd363ec9aaf9f5e78b90f73b304204c48
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jar.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 12.1MB
        • SHA256 42f70dfd212c1eae47c38fc5b1f1c2fb1c0648a1f4d616231609dac28d17ab08
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jarsigner.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        • Size 12.1MB
        • SHA256 0649fe3d108a5d2b019ea24efa562d16b175b2887e583b7354aa1f92c4ae11ff
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 12.1MB
        • SHA256 961b4125154f3c50ee33ef5c2530a955412c60c670eb8c60abc35be6df8c289a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
        • Size 12.3MB
        • SHA256 c304ef893a6e51adfb6f71aa3a787aee68c0ffa092c23a244cf6e7e0747150e5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javac.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
        • Size 12.1MB
        • SHA256 2d58fe4c7801de2820575fa31ab3c521669e5c0c399e6e56c8bd5435a6e4f0b3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javadoc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
        • Size 12.1MB
        • SHA256 7cd147808a345ea6e193c0a9f0b3aa13cb01fe1334a575961df6659efa226837
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javafxpackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
        • Size 12.2MB
        • SHA256 b408bc229aac41c0ae00ccf43f5d316eea0a8e71b9801489043f04442d978770
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javah.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
        • Size 12.1MB
        • SHA256 bebf532e8fd3a962980f36e5f2dbe24835fdd0e36819dc40522dfb72f76aab4b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
        • Size 12.1MB
        • SHA256 d684ea26d51fe9de1084d7ab6f3ca088bed80f4c18eca68c0a0c43842a5c3a04
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javapackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
        • Size 12.2MB
        • SHA256 b536aafeaa601ce018103f9031d29b6e664026f9789a65ac25fcdefc1177e647
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaw.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
        • Size 12.3MB
        • SHA256 38aaaaae6d6782afdb576dc90fc138cc68da5989edd524633de98812f704dfb7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
        • Size 12.5MB
        • SHA256 9d49e91e03cd6798a623d4b1e14f44080c036315b686e8d131da4cb30e688562
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jcmd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
        • Size 12.1MB
        • SHA256 d9d7669c32f57c91ab661ba01e1293fc165b56781d6602e4963c30d9fd99bf6d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jconsole.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
        • Size 12.1MB
        • SHA256 574f82e9a06f1e4c451c392211195c008fb3d6a5b8ed640ea7a7953a47684272
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdb.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
        • Size 12.1MB
        • SHA256 6d145e2f9e0b3c5cf01f2e530676d79e56fcfa916342bfc5713836e4fbc5886c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdeps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
        • Size 12.1MB
        • SHA256 f5c1d74fa89cbfae0f9203218816cda19c39221f48a45db2f7167e4a15f21b71
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jhat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
        • Size 12.1MB
        • SHA256 445af5e60cff08b7fb579948fed5bd630677a5db3686c18ad44f9860015e11db
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jinfo.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
        • Size 12.1MB
        • SHA256 053d7d3d0dd1225704ae6bf90c6f10291c1698fc53fe18a06c1b35a0eaefdc7a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jjs.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
        • Size 12.1MB
        • SHA256 8c83730e39bd890ab7b77c447f70e0afce7d435a794b0dd36ed0878d4ca7bd52
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jmap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
        • Size 12.1MB
        • SHA256 d458aae5c50a50b2eab008b6f31be617b007f7a9f780f43ab740a341e93300c0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
        • Size 12.1MB
        • SHA256 a4b5208c6444e5c97413461245935f31c9246a0393ee82d1c0cad522a6159aa7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jrunscript.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
        • Size 12.1MB
        • SHA256 79ad7e2c8a603106acb2b8320ca0141d003781858751c45543f0fa254c941928
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jsadebugd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
        • Size 12.1MB
        • SHA256 73b73ca7464126d81729861470d9247ea2c09f410c11ea6d22582f4325e395fd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstack.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
        • Size 12.1MB
        • SHA256 cb3aa5bbe074b5b31bfa848b4aceb669f8be9f9e6bccdc4ab7bbaf528759f65e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
        • Size 12.1MB
        • SHA256 e19f9f818ab334541a0f7f8214abc5471bdb7db292abf9b33553a325ea6d9fa4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstatd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
        • Size 12.1MB
        • SHA256 3ec020f9dddea200d7e6320aa53e3ffe43018ed61ce138ea72c1e2ee250521f0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        keytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
        • Size 12.1MB
        • SHA256 f5e7a9c16ad0e0ae75247bc2610872ef29d91f4d024bf6526abfc593e895be37
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        kinit.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
        • Size 6.1MB
        • SHA256 3325de0e2cad4a78795c9ad5261285a3c55db1415f6c9f8b894690d4dfd8b1bf
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        klist.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
        • Size 12.1MB
        • SHA256 6cb1e558f1d1c1ecdcdea116ca1be991b3eba04dba322212aa330a88784d269b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ktab.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
        • Size 12.1MB
        • SHA256 d56714ce80a90d960b74245bf43780d8176e6e1fb54ff1c5c0ee0d6cd910b821
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        native2ascii.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
        • Size 12.1MB
        • SHA256 38236de5263ae0aabc30fdaf1bdf3301e72faf10f713a45e00db04910e22f28b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        orbd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
        • Size 12.1MB
        • SHA256 0969e7b2ac9ca7cb3cf24ca13fdc1215a5caccfce529b4afc9e60cba2e9a5887
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
        • Size 12.1MB
        • SHA256 d87858c792d7937745dc84241605983b16e5e22c71837baf6020d19a3afa163c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        policytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
        • Size 12.1MB
        • SHA256 e42d0812ed870f44f4775868d5850158686808a07c8e70145fb057968b41b8f9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmic.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
        • Size 12.1MB
        • SHA256 bd6044c0c37f94fb343d7fb3a819b0179d5394f457127fa86de732893b2d8b04
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmid.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
        • Size 12.1MB
        • SHA256 9592474c22209b88f2d346601a961b3aae8c2d27b0b27b325851fd1cb0b45add
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmiregistry.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
        • Size 12.1MB
        • SHA256 0cab433f85c182f75013ac1d7fceeed8865f2761bb2bf9eee946e0807ec4c048
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dotnet.exe
        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 12.2MB
        • SHA256 2fbb29a35260276244497ce27f6b27c69b896462884ca34aa669283817e5c359
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 12.1MB
        • SHA256 5371f60a490850afbb12abaead3f17a17d373c564ea57d57557945c9146b6bc9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 12.1MB
        • SHA256 41f4786a67e0b94978b8638ad907c0c291b0e9b2418d02ec1b16b90f1e7bd5ad
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 12.1MB
        • SHA256 88752e74cf4c17dd193cbe51a26ce37a5744917a8723b9cad226d0b0cb7abc22
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download