Overview

overview

8

Static

static

3

2026-08-04...ar.exe

windows10-2004-x64

8

2026-08-04...ar.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    149s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    04/08/2026, 20:05

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-04_5cd96758970bc730082e50826bfc8d09_cobalt-strike_elex_emotet_icedid_remcos_vidar.exe
  • Size 4.0MB
  • Sample260804-ytssqsxtat
  • SHA256 f0d5e7755864fc302f26b2ac4bfa2e6d74d7ba31ce9ef06b3320bce1bbe4d3f4
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
defense_evasiondiscoverypersistenceransomware

Malware Config

Signatures

  • Drops file in Drivers directory 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Sets desktop wallpaper using registry 2 TTPs 2 IoCs
    ransomware
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies Control Panel 4 IoCs
    defense_evasion
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-04_5cd96758970bc730082e50826bfc8d09_cobalt-strike_elex_emotet_icedid_remcos_vidar.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-04_5cd96758970bc730082e50826bfc8d09_cobalt-strike_elex_emotet_icedid_remcos_vidar.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:3784
  • C:\Users\Admin\AppData\Local\Temp\2026-08-04_5cd96758970bc730082e50826bfc8d09_cobalt-strike_elex_emotet_icedid_remcos_vidar.exe
    C:\Users\Admin\AppData\Local\Temp/2026-08-04_5cd96758970bc730082e50826bfc8d09_cobalt-strike_elex_emotet_icedid_remcos_vidar.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:4792

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        7z.exe
        • Path C:\Program Files\7-Zip\7z.exe
        • Size 4.6MB
        • SHA256 35bc533b07bb078055a5f1f13ba75d3fc100ec7c41124dbc94c96f883e4e239f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        7zFM.exe
        • Path C:\Program Files\7-Zip\7zFM.exe
        • Size 5.0MB
        • SHA256 8a9cc83505df9d2fa4b2ee4c89b5557d7a2223976453139c99b2a0fa50ebab2e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        7zG.exe
        • Path C:\Program Files\7-Zip\7zG.exe
        • Size 8.7MB
        • SHA256 6b5b14318c55bf9df52e6567354d2638f388aa957b662f15c3bc01d2b787300e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Uninstall.exe
        • Path C:\Program Files\7-Zip\Uninstall.exe
        • Size 8.0MB
        • SHA256 32af10a8b9704e03ef355bc37fdc8b97a5f6112bee9aaf90578eaec13d28b3f7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        AppVShNotify.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
        • Size 8.3MB
        • SHA256 07fbacca0d74a7c0dce021a5f579cef8841faf1e38157be4b2094a81e6f0dc6d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        InspectorOfficeGadget.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
        • Size 8.1MB
        • SHA256 41d45cf0c7cf570a2d16983e9cbab94c74bf0cc3b8c96ffd9ad67a2dc65b6040
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        IntegratedOffice.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
        • Size 12.1MB
        • SHA256 d3e933c7c9db3e0d9b0577e2769766d46c359c6ec51e9116d6e749f0fae32cb3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MavInject32.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
        • Size 4.4MB
        • SHA256 e9d1067fc13fa2147190bc30501b87e22caa2e6f0af379e19260b16f3cc8efbb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        OfficeC2RClient.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
        • Size 31.5MB
        • SHA256 70ffca0e055064da01baa8baadf8ea9bcc09a9fd7a3be2bc4e33241fc23a4f27
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appvcleaner.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
        • Size 10.2MB
        • SHA256 d52455a6f5c3eebe5258b2cfde701f7d19b8970398a9cd2f94bcafa5119e55c0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VSTOInstaller.exe
        • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
        • Size 8.1MB
        • SHA256 54a8912b062e9a1e977ec3bd3f865dcfddfaf7f3c6ebd63d9955b4a5df07b26a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrmstp.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        • Size 14.1MB
        • SHA256 afcd22079703752ad624fa6cef7a3bda78316e940da0123c01cc71f3f38384f5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_pwa_launcher.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 9.7MB
        • SHA256 6648ad310661649839c54230bc9bcaeeaeb80f0ec5a5565f9b34b824f78ae0bb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevated_tracing_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 11.5MB
        • SHA256 80a3f18cd7acfa5093906f2f38734ebec9865b73d749a2ec55acea84e24d2bda
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 10.3MB
        • SHA256 457aaf5b79f9672c11dfa269212fe6544b8ece05924a725dd87a1fcdbf3c260c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notification_helper.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 9.7MB
        • SHA256 56a7583a9157487f29f8b703c0173db42edafe38b6ea27099b344baf373a3769
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        os_update_handler.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 9.9MB
        • SHA256 d55d00c341bd3adaad0b5a7dc3b3f2e88b620206ba582de4f10ae5b65cca6a1c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 11.1MB
        • SHA256 977a8a910f3a09a743b65159503e584405af0377a51595729634f97a6919d25f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_proxy.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 9.5MB
        • SHA256 77fb467b5ca9747018c654c799cd5ac8895ba127c99ac6cab5a5393b68e2a9ab
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 8.1MB
        • SHA256 65e565cf728a6e9bab065fafb1dac6d8875139879e43a1d4205c368a45ca737c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 8.1MB
        • SHA256 d040ec8074d73feb1765738efa458fdbe228e8df7539cc34d2e3015481b5c0c2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 8.1MB
        • SHA256 5ae2756af4babc5ab161341693c10e0d3c1e5f343aaa456c3557ef15dcfab014
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 8.1MB
        • SHA256 2d6ac1435f4f64472ca0d2d572cb0ec32bb604b4c46795d6547c3e20d004e1de
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jar.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 8.1MB
        • SHA256 15dfbf0757c6a152229fd71c0bf19d492c22be73c6904d7d78fda1e184e7b069
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jarsigner.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        • Size 8.1MB
        • SHA256 9ae71bb3a827cdac2a92522663b57dbd15baa50665bc8f2a8f3ca1a81dbb8c6c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 8.1MB
        • SHA256 01d84887c35fa5b5db7535b27bda6d0c0c7e5f2adeb735d0f1ada08d36e1ea39
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
        • Size 8.3MB
        • SHA256 6ea4b24635f345718ce8e07f680b7eba7df1c23d0baab63117f8ebe53e578109
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javac.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
        • Size 8.1MB
        • SHA256 b5988c4eb17f9a5388074cf557949b806019aa634025e98c69712f7f43c2af54
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javadoc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
        • Size 8.1MB
        • SHA256 91600d27906dc6efb0a47c302d80e28e4614d44fa77f5f667a21a2306f9d12ef
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javafxpackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
        • Size 8.2MB
        • SHA256 ecc4ef51709a429cee5b5c8581e7dd7c2faa98f08a87d73070582ddb774209d9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javah.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
        • Size 8.1MB
        • SHA256 5b3c5ea218bfa72671443a884a6377206e2b2aae57ad7a4dc1d6f79f9e93355c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
        • Size 8.1MB
        • SHA256 877e571467d4f6d3e637157d79897741173c8bcb5f60768417f73f0bc2245a84
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javapackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
        • Size 8.2MB
        • SHA256 b35e37f219579ccde9d94e393b3d5a5e044b8613e26af9f8831f92f20e8f8a0b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaw.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
        • Size 8.3MB
        • SHA256 d3e47233bdadff6e713f5a291d871e1386c84d8d0ffbe4e336fa0ff1ff0e6e9d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
        • Size 8.5MB
        • SHA256 d0f5b752bcd11dc35ff4db9a2b7bcfe4a3d93e473bad6e34fab85ea355373a60
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jcmd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
        • Size 8.1MB
        • SHA256 4c722008b59d287824a0b3ea6f2c8ef76ec4ce1c548bf8858e42cbed51abe85e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jconsole.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
        • Size 8.1MB
        • SHA256 691836245dfd9eab08f48e94fe5fe59fdd322ccbceed459bbafa19b896f46928
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdb.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
        • Size 8.1MB
        • SHA256 e4c92c4d30fd5842173f1e8f75f74832f004d62ffd212f6ca14144eaca1afc48
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdeps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
        • Size 8.1MB
        • SHA256 2cb534d8746a7ec9e03350b6074e18da4f174f2f44da0f612dfb83f7de3541c8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jhat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
        • Size 8.1MB
        • SHA256 f55b5a066333b9de65fdd12bcb56149e9fe9af474f3e2a6e6bba049f99392f84
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jinfo.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
        • Size 8.1MB
        • SHA256 087e1a56395df7c0e9802e0728937f9405b5002b495210e2e82a07bf7c3b63f7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jjs.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
        • Size 8.1MB
        • SHA256 ca73eac13420c9aa05663887ae8a30a249b04b164471f9ce594592f229f24920
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jmap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
        • Size 8.1MB
        • SHA256 0557cacabef1ae4a255e82fd15bbf5493a868dd2771df26ac422547dd575df02
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
        • Size 8.1MB
        • SHA256 e010d0aef566c38d5f799339e8c9e89f592e56cbea496948af0dc62f1f01369a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jrunscript.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
        • Size 8.1MB
        • SHA256 ee25003d11265b266ec9a965b917f22d99b41c01da2ab0adaa9ba7a77c90f483
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jsadebugd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
        • Size 8.1MB
        • SHA256 05a54d120242a4d8a5dc3ffed3a18670af594146736f0d8cd6ebd651a1238ba9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstack.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
        • Size 8.1MB
        • SHA256 2dc3fb608078a744561722ac06f07235b041a7a6facf0e5fcda4b8702d5e36e1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
        • Size 8.1MB
        • SHA256 98f63aaccf1a4b59417f8579ad31a5e55c1f762d3f4c3597b88772ef636d1846
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstatd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
        • Size 8.1MB
        • SHA256 0e0aaa2158e421d3e93755239752c4e56628f4f6911f06aad7765f42718986d8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        keytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
        • Size 8.1MB
        • SHA256 bfbb9c456a84c307422ceed9995eab34fae28eb6553353d040908b6158111284
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        kinit.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
        • Size 8.1MB
        • SHA256 28cf3ea518fe20f57f321fc102420ac9b9e35deda60e1ef83b015f1cfa45944f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        klist.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
        • Size 8.1MB
        • SHA256 b4da8be9fbb4a58ffd9df044b7cf0057aa6690a8a4c2f79b58be6ac0dc26a121
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ktab.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
        • Size 8.1MB
        • SHA256 508754de537525ede096d7b5d3e96d534e53c1b6ec93043119d99a416ac4d95b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        native2ascii.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
        • Size 8.1MB
        • SHA256 fe29bb6dc36395ef0826b5765ded432a313a1eee29516c978d820f040ac54a16
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        orbd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
        • Size 8.1MB
        • SHA256 6fc3a8a0650259953da854759f39161cbc7aac2d3524120f13826e6ae7176dea
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
        • Size 8.1MB
        • SHA256 d43295953e89ae72cf318a102a18d3508f1034d833f82b3a0e0fae85aa3d2e48
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        policytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
        • Size 8.1MB
        • SHA256 be4067b18654c0d001ad695067b4d0eb027cbfb0f1dc83257e056b98d29d2397
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmic.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
        • Size 8.1MB
        • SHA256 2be7efeb91ff46e5c66d65230d5283528b7af62ed8cc6a2612f5eac6c6690b36
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmid.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
        • Size 8.1MB
        • SHA256 3a7be822d7cd08a5fb02b65b85e4eebf1c8e29e7310c07afc2319cb651cc41d6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dotnet.exe
        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 8.2MB
        • SHA256 8b1564470b1812939138181c7bf16cf9f5549add6abe62d3020e3b4a0c2f7b74
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 8.1MB
        • SHA256 da2b1fb748d357d543ca86f92f4b8148086248181a23b124ec6d414a5cb198c9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 8.1MB
        • SHA256 7e95df8dde31db002a9e42407abdb65acae209608c9dbd9c9f49ea2c28555ae2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 8.1MB
        • SHA256 2cbdf54072d9820179bb9065dc5364fe679d02a232525bdaf19279289bed7f95
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download