Overview

overview

8

Static

static

3

2026-08-07...ar.exe

windows10-2004-x64

8

2026-08-07...ar.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    150s
  • max time network
    114s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    08/08/2026, 01:36

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-07_315415ac5c4ab1ce735b3f46b24c10e6_cobalt-strike_elex_emotet_glassworm_icedid_remcos_vidar.exe
  • Size 12.8MB
  • Sample260808-b1nq2axerd
  • SHA256 c6f0fd9b9aa14bbc5235643386eca212506d0f23cd300bab0c520139d407e459
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
defense_evasiondiscoverypersistenceransomware

Malware Config

Signatures

  • Drops file in Drivers directory 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Sets desktop wallpaper using registry 2 TTPs 2 IoCs
    ransomware
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies Control Panel 4 IoCs
    defense_evasion
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-07_315415ac5c4ab1ce735b3f46b24c10e6_cobalt-strike_elex_emotet_glassworm_icedid_remcos_vidar.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-07_315415ac5c4ab1ce735b3f46b24c10e6_cobalt-strike_elex_emotet_glassworm_icedid_remcos_vidar.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:4296
  • C:\Users\Admin\AppData\Local\Temp\2026-08-07_315415ac5c4ab1ce735b3f46b24c10e6_cobalt-strike_elex_emotet_glassworm_icedid_remcos_vidar.exe
    C:\Users\Admin\AppData\Local\Temp/2026-08-07_315415ac5c4ab1ce735b3f46b24c10e6_cobalt-strike_elex_emotet_glassworm_icedid_remcos_vidar.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:4840

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        7zFM.exe
        • Path C:\Program Files\7-Zip\7zFM.exe
        • Size 13.8MB
        • SHA256 3bf08c96a76afa75227c94481b7da70f4423d1b99a621b69e77a1cb090d172dd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        7zG.exe
        • Path C:\Program Files\7-Zip\7zG.exe
        • Size 13.5MB
        • SHA256 fe1450d3ac8a1bce414a38aa4b368695274ea46cdc85ea054e9e6070024edc18
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Uninstall.exe
        • Path C:\Program Files\7-Zip\Uninstall.exe
        • Size 25.6MB
        • SHA256 bcc263e94c1d6c7b5261c8df8bf6267a62f4d683b7361d6ce22ff4d81a6fd4c7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        AppVShNotify.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
        • Size 25.9MB
        • SHA256 afac024d3bd963356609ab684129b3c654261bf4b37e36e63fe7681be3253781
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        InspectorOfficeGadget.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
        • Size 25.7MB
        • SHA256 665be76ce55cd2742213689d64ae6fc55ff9338bef94d6b9fd79107bc5500b34
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MavInject32.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
        • Size 26.0MB
        • SHA256 e400ffb30275cdd0b160aa8314603609349f7e8e7a33894a695d9045fc679701
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        OfficeC2RClient.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
        • Size 49.1MB
        • SHA256 863b4ead5e8439f5982806b61a98cace5ec69fc893f949db6dd8c73868091658
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrmstp.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        • Size 31.7MB
        • SHA256 22c8098275834f67b0dae6527a9d8b4f35b268cada9e2b34a5e6ff823a04f7f2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_pwa_launcher.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 27.3MB
        • SHA256 5cd9c2360e885fb2657b5463e439c1cf26354623fca2b5d6b622c6258b908a0a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevated_tracing_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 29.1MB
        • SHA256 ef5fc7ca7d5fc07fde19d5d73c334f15ea8d68ca861349cd5151ab0eddfc9917
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 27.9MB
        • SHA256 fe9f8c26a1d4584e80f7069edd1122ec4b5ac04904d44ebb952cbfc39a282a48
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notification_helper.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 27.3MB
        • SHA256 b63ba241ef230c5f6579c32c748763734d05b35544378acf3ade5a689d73dbde
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        os_update_handler.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 27.5MB
        • SHA256 95ed4c520027d883104a8d3c3919704f648ff57934a5da927cd7b099107d41db
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 28.7MB
        • SHA256 b5ed1759cfdb9f2f85e4d38ed4ce34180d4f22165ae5d42389b788e54477ed1a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 25.7MB
        • SHA256 822580e30244712feb11ef3c91a2707f78a98102159425d83d0c3bfe1e6bb184
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 25.7MB
        • SHA256 26482c5eff490a4cf992d6f2218af70e7abc8af0d74d7035c3c35e6c5173ea6b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jar.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 64KB
        • SHA256 5ee579a102ce5bf0cbd0019815419a15a91d52dccc5939636170e988272f403c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jarsigner.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        • Size 25.7MB
        • SHA256 2b9f75cebc548e1ef1c5364b90005c91e7135da31c2ffd0832f839da152f9619
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 25.7MB
        • SHA256 f11049afe7bf0f30ce8c46f871c5b7bde863bce3151cd3e1629efd2de22a4ee1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javac.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
        • Size 25.7MB
        • SHA256 42a0ae4aac0baf98b43c29b1ccdee8feb5785a1553c211d730ea16ea1fd072bb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javadoc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
        • Size 25.7MB
        • SHA256 a160911c9b4f470d3e01605b8717cd03fee5d98d68e4f0125a0fda533f2c99e4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javafxpackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
        • Size 25.8MB
        • SHA256 3a5a2a6b0fbd64dc99cbbcbc37a048368984484c386b49671cec6ca4c4d3fd8e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javah.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
        • Size 25.7MB
        • SHA256 f0c8db68638bf115c60fb8d66d9b02ce63428f25ab37e50e9ec645b6fabbcfb4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
        • Size 25.7MB
        • SHA256 9d3817de98ba7367766735fe5bf644ab317067fcb22fa5adf815d66754ae9294
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javapackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
        • Size 25.8MB
        • SHA256 a246db63f599a45440ca1439abaabaf25bd8387a894b95b4f2261be1f486bcb1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaw.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
        • Size 25.9MB
        • SHA256 2e2083e44c88da6b8bc3f6fa0d52f6c129e3492f8b8c93d6fdda14d1509c0f32
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
        • Size 26.1MB
        • SHA256 bf5d0ec078d6da8c17390bcb238f14d3985baa316b500c4cab6a94f3ce41f9c3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jcmd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
        • Size 25.7MB
        • SHA256 abc76c7f72b55a468cd998f64bc92d9f72b7ef8853dfee41fd40494559e4407c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdb.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
        • Size 25.7MB
        • SHA256 66d382cac668bd9bebf3574e5963367f0e8d2ed2bffef50ffcd05dc70a93558c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdeps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
        • Size 25.7MB
        • SHA256 b6bc92bed79cb30cab5d2efae2092a25b631352a47c21893bfd06f50f297bad9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jhat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
        • Size 25.7MB
        • SHA256 6fe65bd38df4f2c52129b15b4f06e4cde1000d1bc0a42565077f7f34f3b6e301
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jinfo.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
        • Size 25.7MB
        • SHA256 0a81712c149cf6a321a7f0cc627d68a7c516c787e7151a66c77a2886c480ced8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jjs.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
        • Size 25.7MB
        • SHA256 d18895a5848681bab0d615f9ec04f815718da7b089f5d80d7dbd893e0cc378f4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jmap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
        • Size 25.7MB
        • SHA256 26aba22ef2d3dca134eec2097d025d7a560447a92f8ae5ca5fea1013ccf3606a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
        • Size 25.7MB
        • SHA256 f9c0e44a07159383f82499aa7e7e36c4781dc84412a85b358f6e90259136b5e6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jrunscript.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
        • Size 25.7MB
        • SHA256 6ce6980eaa8cd0d5ee79288c178759e212046d2582893435d08169b9f7f98e7c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jsadebugd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
        • Size 25.7MB
        • SHA256 001e948f015954b71bb3a2e7bac80e03bd4d1e32f33bdcf6d884930a44725379
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstack.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
        • Size 25.7MB
        • SHA256 24bd8d3c304cfd7ef0958e2d305e0e3bb7d8446f695d3c5f85f0bad56640c555
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
        • Size 25.7MB
        • SHA256 f9ab6a6dfaf5db04774bb550c06e3f5f2984642fa1e3a1d34d4df1b73a7be8a4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstatd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
        • Size 25.7MB
        • SHA256 be0eb3f98dfd0d4f32abcea9b0d604bf7227c5b0f35e18425a4f373cc666d01a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        keytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
        • Size 25.7MB
        • SHA256 a31dab4409d3820f8008197c95de412fc69b0ec877d10a7145712b31d56f5e38
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        kinit.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
        • Size 25.7MB
        • SHA256 5ee86478befbb9e702e5ae53a50b4937cf804a4a83d160173e83b1a709afe1c1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        klist.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
        • Size 25.7MB
        • SHA256 38e0d1d8be0d264352a394f1ab8265f82c887318d8f1c55c41ceb7977fbd56a1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ktab.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
        • Size 25.7MB
        • SHA256 8fbd7b4c1f0f31d5bb947491ae07e592d084f8bc5254139a320644f998901bad
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        native2ascii.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
        • Size 25.7MB
        • SHA256 d92097811a34bb1fe9c23bee0c3ea3ec58679831aad52daaa088e63203fcd108
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        orbd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
        • Size 25.7MB
        • SHA256 2d611b233d33106a371c4df88647d9e976c2d6d54b70e585d96632c51559ac00
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
        • Size 25.7MB
        • SHA256 5a4191aeefeb68df526fc60f68e5ec7effb6fa55e604eb3541355d04458b29d7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        policytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
        • Size 25.7MB
        • SHA256 c92af56c28ac3bdbd79e9e66072e6c9a9fa447e53e0900dcfd7423d72085d0b7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmic.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
        • Size 25.7MB
        • SHA256 7e6e7aef2e411051b8315c824961846009f4705d66eb9ca88437896803eddedc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmid.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
        • Size 25.7MB
        • SHA256 eb4cff6769e419e47fefd75486e619c9bd1dabf31bd701d253c73ee97f83aaed
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmiregistry.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
        • Size 25.7MB
        • SHA256 73b8c18111b2e24edc85bf419ee22e7a90eaec810e33776f1c766d28a62d7bbb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        schemagen.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
        • Size 25.7MB
        • SHA256 ffb5ae080522e6b4ee74023a803243ebba86f667fed491335322f7682134b134
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        serialver.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
        • Size 25.7MB
        • SHA256 0042ccb275c1724725b3cda790dc6541ff162b2678bd068e051f10299d3ea151
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dotnet.exe
        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 25.8MB
        • SHA256 605b50bca4968e08e88521f0c41891e6b0b51222886e7a0296092e6731ee037d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download