Overview

overview

8

Static

static

3

2026-08-04...ar.exe

windows10-2004-x64

8

2026-08-04...ar.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    148s
  • max time network
    148s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260513-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    04/08/2026, 20:05

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-04_5cd96758970bc730082e50826bfc8d09_cobalt-strike_elex_emotet_icedid_remcos_vidar.exe
  • Size 4.0MB
  • Sample260804-ytssqsxtat
  • SHA256 f0d5e7755864fc302f26b2ac4bfa2e6d74d7ba31ce9ef06b3320bce1bbe4d3f4
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
defense_evasiondiscoverypersistenceransomware

Malware Config

Signatures

  • Drops file in Drivers directory 3 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Sets desktop wallpaper using registry 2 TTPs 2 IoCs
    ransomware
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies Control Panel 4 IoCs
    defense_evasion
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-04_5cd96758970bc730082e50826bfc8d09_cobalt-strike_elex_emotet_icedid_remcos_vidar.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-04_5cd96758970bc730082e50826bfc8d09_cobalt-strike_elex_emotet_icedid_remcos_vidar.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:2852
  • C:\Users\Admin\AppData\Local\Temp\2026-08-04_5cd96758970bc730082e50826bfc8d09_cobalt-strike_elex_emotet_icedid_remcos_vidar.exe
    C:\Users\Admin\AppData\Local\Temp/2026-08-04_5cd96758970bc730082e50826bfc8d09_cobalt-strike_elex_emotet_icedid_remcos_vidar.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:2104

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        7zFM.exe
        • Path C:\Program Files\7-Zip\7zFM.exe
        • Size 5.0MB
        • SHA256 8a9cc83505df9d2fa4b2ee4c89b5557d7a2223976453139c99b2a0fa50ebab2e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        7zG.exe
        • Path C:\Program Files\7-Zip\7zG.exe
        • Size 4.7MB
        • SHA256 4d693f34aa5f3d99d049eeb081af07f874beb16bf78a61b28c710b9cc786d164
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Uninstall.exe
        • Path C:\Program Files\7-Zip\Uninstall.exe
        • Size 8.0MB
        • SHA256 32af10a8b9704e03ef355bc37fdc8b97a5f6112bee9aaf90578eaec13d28b3f7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ApproveRepair.exe
        • Path C:\Program Files\ApproveRepair.exe
        • Size 8.5MB
        • SHA256 4261af98421e04f45d9a788986ac50033393b55e5acc0f95c4516897dcad95f8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        AppVShNotify.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
        • Size 4.0MB
        • SHA256 f0d5e7755864fc302f26b2ac4bfa2e6d74d7ba31ce9ef06b3320bce1bbe4d3f4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        InspectorOfficeGadget.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
        • Size 8.1MB
        • SHA256 41d45cf0c7cf570a2d16983e9cbab94c74bf0cc3b8c96ffd9ad67a2dc65b6040
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        IntegratedOffice.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
        • Size 12.1MB
        • SHA256 d3e933c7c9db3e0d9b0577e2769766d46c359c6ec51e9116d6e749f0fae32cb3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MavInject32.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
        • Size 8.4MB
        • SHA256 0a3406e8c7bccbbd3b4f329150c9391efe7530b6426301d8e1bd9b042290331f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrmstp.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        • Size 10.1MB
        • SHA256 08d57dc3167a04592fbd80116ab84f58281b88787f3aa1de987eb8ce738e39b4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 6.3MB
        • SHA256 d2d38b7a902b5851acc82a535b9d096955eb6f9367293f94be6a44503e55978c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notification_helper.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 5.6MB
        • SHA256 00613b989f50cdb49f5ad8ecc50fca551723f00c5940d1e9e80e629e067c1fdb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        os_update_handler.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 5.9MB
        • SHA256 f890cb949a55637628bfff941b037c051a00565c4ba8cb2aefecf128d06986e9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 4.0MB
        • SHA256 a622019f95be40565fdc05704e1fb5d36363c4d3e720bf74c3387e1f2f42c719
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 8.1MB
        • SHA256 d040ec8074d73feb1765738efa458fdbe228e8df7539cc34d2e3015481b5c0c2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 8.1MB
        • SHA256 5ae2756af4babc5ab161341693c10e0d3c1e5f343aaa456c3557ef15dcfab014
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 8.1MB
        • SHA256 2d6ac1435f4f64472ca0d2d572cb0ec32bb604b4c46795d6547c3e20d004e1de
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jar.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 8.1MB
        • SHA256 15dfbf0757c6a152229fd71c0bf19d492c22be73c6904d7d78fda1e184e7b069
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jarsigner.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        • Size 8.1MB
        • SHA256 9ae71bb3a827cdac2a92522663b57dbd15baa50665bc8f2a8f3ca1a81dbb8c6c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 8.1MB
        • SHA256 01d84887c35fa5b5db7535b27bda6d0c0c7e5f2adeb735d0f1ada08d36e1ea39
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
        • Size 8.3MB
        • SHA256 6ea4b24635f345718ce8e07f680b7eba7df1c23d0baab63117f8ebe53e578109
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javac.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
        • Size 8.1MB
        • SHA256 b5988c4eb17f9a5388074cf557949b806019aa634025e98c69712f7f43c2af54
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javadoc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
        • Size 8.1MB
        • SHA256 91600d27906dc6efb0a47c302d80e28e4614d44fa77f5f667a21a2306f9d12ef
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javafxpackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
        • Size 8.2MB
        • SHA256 ecc4ef51709a429cee5b5c8581e7dd7c2faa98f08a87d73070582ddb774209d9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javah.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
        • Size 4.0MB
        • SHA256 32ec5d24c2b55879b307df775d6cbda722a85177b3ab2e579919c5d40c627511
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
        • Size 8.1MB
        • SHA256 877e571467d4f6d3e637157d79897741173c8bcb5f60768417f73f0bc2245a84
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javapackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
        • Size 8.2MB
        • SHA256 b35e37f219579ccde9d94e393b3d5a5e044b8613e26af9f8831f92f20e8f8a0b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaw.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
        • Size 8.3MB
        • SHA256 d3e47233bdadff6e713f5a291d871e1386c84d8d0ffbe4e336fa0ff1ff0e6e9d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
        • Size 8.5MB
        • SHA256 d0f5b752bcd11dc35ff4db9a2b7bcfe4a3d93e473bad6e34fab85ea355373a60
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jcmd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
        • Size 8.1MB
        • SHA256 4c722008b59d287824a0b3ea6f2c8ef76ec4ce1c548bf8858e42cbed51abe85e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jconsole.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
        • Size 8.1MB
        • SHA256 691836245dfd9eab08f48e94fe5fe59fdd322ccbceed459bbafa19b896f46928
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdb.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
        • Size 8.1MB
        • SHA256 e4c92c4d30fd5842173f1e8f75f74832f004d62ffd212f6ca14144eaca1afc48
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdeps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
        • Size 8.1MB
        • SHA256 2cb534d8746a7ec9e03350b6074e18da4f174f2f44da0f612dfb83f7de3541c8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jhat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
        • Size 8.1MB
        • SHA256 f55b5a066333b9de65fdd12bcb56149e9fe9af474f3e2a6e6bba049f99392f84
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jinfo.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
        • Size 8.1MB
        • SHA256 087e1a56395df7c0e9802e0728937f9405b5002b495210e2e82a07bf7c3b63f7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jjs.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
        • Size 8.1MB
        • SHA256 ca73eac13420c9aa05663887ae8a30a249b04b164471f9ce594592f229f24920
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jmap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
        • Size 8.1MB
        • SHA256 0557cacabef1ae4a255e82fd15bbf5493a868dd2771df26ac422547dd575df02
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
        • Size 8.1MB
        • SHA256 e010d0aef566c38d5f799339e8c9e89f592e56cbea496948af0dc62f1f01369a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jrunscript.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
        • Size 8.1MB
        • SHA256 ee25003d11265b266ec9a965b917f22d99b41c01da2ab0adaa9ba7a77c90f483
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jsadebugd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
        • Size 8.1MB
        • SHA256 05a54d120242a4d8a5dc3ffed3a18670af594146736f0d8cd6ebd651a1238ba9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstack.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
        • Size 8.1MB
        • SHA256 2dc3fb608078a744561722ac06f07235b041a7a6facf0e5fcda4b8702d5e36e1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
        • Size 8.1MB
        • SHA256 98f63aaccf1a4b59417f8579ad31a5e55c1f762d3f4c3597b88772ef636d1846
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstatd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
        • Size 8.1MB
        • SHA256 0e0aaa2158e421d3e93755239752c4e56628f4f6911f06aad7765f42718986d8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        keytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
        • Size 8.1MB
        • SHA256 bfbb9c456a84c307422ceed9995eab34fae28eb6553353d040908b6158111284
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        kinit.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
        • Size 8.1MB
        • SHA256 28cf3ea518fe20f57f321fc102420ac9b9e35deda60e1ef83b015f1cfa45944f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        klist.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
        • Size 8.1MB
        • SHA256 b4da8be9fbb4a58ffd9df044b7cf0057aa6690a8a4c2f79b58be6ac0dc26a121
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ktab.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
        • Size 8.1MB
        • SHA256 508754de537525ede096d7b5d3e96d534e53c1b6ec93043119d99a416ac4d95b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        native2ascii.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
        • Size 8.1MB
        • SHA256 fe29bb6dc36395ef0826b5765ded432a313a1eee29516c978d820f040ac54a16
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        orbd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
        • Size 8.1MB
        • SHA256 6fc3a8a0650259953da854759f39161cbc7aac2d3524120f13826e6ae7176dea
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
        • Size 8.1MB
        • SHA256 d43295953e89ae72cf318a102a18d3508f1034d833f82b3a0e0fae85aa3d2e48
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        policytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
        • Size 8.1MB
        • SHA256 be4067b18654c0d001ad695067b4d0eb027cbfb0f1dc83257e056b98d29d2397
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmic.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
        • Size 8.1MB
        • SHA256 2be7efeb91ff46e5c66d65230d5283528b7af62ed8cc6a2612f5eac6c6690b36
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmid.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
        • Size 8.1MB
        • SHA256 3a7be822d7cd08a5fb02b65b85e4eebf1c8e29e7310c07afc2319cb651cc41d6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmiregistry.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
        • Size 8.1MB
        • SHA256 d38727d9e3e8c09dfb896b3d522c3aa43a45f6c1fae97eba27aac0e7f6b7ca15
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        schemagen.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
        • Size 8.1MB
        • SHA256 f6bc4eb0e6e2185a23cc9ab474589952aed1448ac7666885e84b181bdaecff96
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        serialver.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
        • Size 8.1MB
        • SHA256 ab7abbb303fa1d0a160ae01d78a72fc3c515f97ec6bf532e62b2a5d9f417311c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        servertool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
        • Size 8.1MB
        • SHA256 dd44f616dcc28c65e02896435dfcf5047943fed621481c43b3f03e459614ae34
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        tnameserv.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
        • Size 8.1MB
        • SHA256 dbe1112d90111db8baebe74a7dd9a40a46f2b24d57eae61b43867f9669305f6a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        unpack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\unpack200.exe
        • Size 8.2MB
        • SHA256 b551377df79cea999c27001f7c082f2428de47872a2b5e7435c74ceeeeb4c11b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        wsgen.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
        • Size 8.1MB
        • SHA256 397c246d3e324d86e318e10067aa96f7a85c172b395fb2b7749c6f9df7a9b016
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        wsimport.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
        • Size 8.1MB
        • SHA256 6e4adfee5dd9e296fd491c4caa7322da4b485fdb2d583e71db3597d9b9eb8af1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        xjc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
        • Size 8.1MB
        • SHA256 9d272a78701ac59492abcc1fa6b8fc5dd4998b8cac9bb8359197d0a5fc88d863
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe
        • Size 8.1MB
        • SHA256 925f6a64acedd007b94649ccb5ed473b7e3c4e7ba1fe8159729fdad5e3b23a85
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 4.1MB
        • SHA256 93459627b5d6f3064f47d503537ef6c0438b74c64114c90b9071378e3c27bf2a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download