Overview

overview

8

Static

static

3

2026-08-08...ar.exe

windows10-2004-x64

8

2026-08-08...ar.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    149s
  • max time network
    152s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    08/08/2026, 13:22

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-08_c8195fa12d410a2de751f21d6e93490b_cobalt-strike_elex_emotet_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe
  • Size 3.0MB
  • Sample260808-qmp49sxepe
  • SHA256 2a35bf8f1d76bc535c6f2bd984ef8cb725aab3d89adb533804ce76ac01d5a866
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
defense_evasiondiscoverypersistenceransomware

Malware Config

Signatures

  • Drops file in Drivers directory 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Sets desktop wallpaper using registry 2 TTPs 2 IoCs
    ransomware
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies Control Panel 4 IoCs
    defense_evasion
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-08_c8195fa12d410a2de751f21d6e93490b_cobalt-strike_elex_emotet_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-08_c8195fa12d410a2de751f21d6e93490b_cobalt-strike_elex_emotet_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:4216
  • C:\Users\Admin\AppData\Local\Temp\2026-08-08_c8195fa12d410a2de751f21d6e93490b_cobalt-strike_elex_emotet_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe
    C:\Users\Admin\AppData\Local\Temp/2026-08-08_c8195fa12d410a2de751f21d6e93490b_cobalt-strike_elex_emotet_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:5088

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        7z.exe
        • Path C:\Program Files\7-Zip\7z.exe
        • Size 3.0MB
        • SHA256 2a35bf8f1d76bc535c6f2bd984ef8cb725aab3d89adb533804ce76ac01d5a866
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Uninstall.exe
        • Path C:\Program Files\7-Zip\Uninstall.exe
        • Size 6.0MB
        • SHA256 a7fede796fee4b260314f4727e6734bbe6dcdf650335a874846e8cb2dc823834
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        AppVShNotify.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
        • Size 6.3MB
        • SHA256 b85082b8b852c367737f6922db460285fb068c022eab4334d7c6ceaaeeeedd76
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        InspectorOfficeGadget.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
        • Size 6.0MB
        • SHA256 cd00f206669a5ec1d1ec393c0cf1e50f69ef7d6391aace6d3477910f5c1ab7b8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        IntegratedOffice.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
        • Size 10.1MB
        • SHA256 b8b8b7f5f63fad3a3e975a4eb45a11ceffc3301df7a3a9b805df0bca6dc83fed
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MavInject32.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
        • Size 3.4MB
        • SHA256 e41f13dbd4689be689f78409f2153e967c3d68f32f61fcfeac578494105e50a4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        OfficeC2RClient.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
        • Size 29.5MB
        • SHA256 08f2c0d4ad458152b0917fb05ed6c909571c40576401e3813f8bb879997ba579
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appvcleaner.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
        • Size 8.1MB
        • SHA256 fa1bf5b6cb770c43991c3ba116bcf29b1fe028ed4847c37ef94c0d3688a5bfdb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VSTOInstaller.exe
        • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
        • Size 6.1MB
        • SHA256 43d97664f4b485a28890cc7a8c3dd94cdf7a92687455c140557a64fee4bb8f33
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrmstp.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        • Size 12.1MB
        • SHA256 f9cd939f30151153fca3540c23bc6749079378493f9c4fbcee35867906f4d79d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_pwa_launcher.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 7.7MB
        • SHA256 b0622fb3e713a872a2436ad441e5afdaf68e2c30a4de27a4c403efc636546978
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevated_tracing_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 9.5MB
        • SHA256 df8f61aa6ddc8181396bcbbab17e7ccc7879c9a3a708bfb8f166e4028cfb83ae
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 8.3MB
        • SHA256 2dc37d3b086f0d59d086ca282458a4484c6ab3b419d03a7477517b0c47748542
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notification_helper.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 7.6MB
        • SHA256 c56d501e46bbd6263ec872c8398d6adcf8648e2146cd09ec34b99306fd5a2df0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        os_update_handler.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 7.9MB
        • SHA256 7c55d67d6f5bd66a41b6b438e88082dc54a073dd0b0fb138388583bc474bbcb7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 9.1MB
        • SHA256 984cfad710eb7b5156a9b44433a97e56d605670d2ff69f7aa4e8e845ebd34a72
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_proxy.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 7.4MB
        • SHA256 4f65d939fefe038d3efc8d964e333c7ecf3759b2e8eaa8957223281edad46e93
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 6.0MB
        • SHA256 2aa92366de3c1a48a4f6ed3d5cdd2a395c59ee4d4b39ef86d69904f74171384a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 6.0MB
        • SHA256 c47174b48135dd7327b784405868dfc3d13ce9f2fd43a1d3acf1436d5eda850f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 6.0MB
        • SHA256 ac7610e816a29830c0c9132959bfbffb01f7a888fd8b68aa52e3780ddde44ff8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 6.0MB
        • SHA256 91588f41bb01a7ffc384a9d7952bbad7546680c28a665f2aece06bff23a4e58d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jar.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 6.0MB
        • SHA256 3eb015486c12700935c7590630f75e8f58fdf6eaa4b28aaa0e652a632ea5820e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jarsigner.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        • Size 6.0MB
        • SHA256 003ce2fc5f7f85e3ecdfffc64550db1f4ecc9063c62c3bcebb6f7028cbdb2b19
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 6.0MB
        • SHA256 604798134da2360aedcfabf098e21d2291bf92e1ee0c7ff463a4bbcb5f386c30
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
        • Size 6.3MB
        • SHA256 ac5ef83e5670967f375974464844546e5ca7b5abac58c33a5fd0496a6895ab7a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javac.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
        • Size 6.0MB
        • SHA256 186b64040d11619af487405341a4defc9c597e3956305729761453ecf46ce082
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javadoc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
        • Size 6.0MB
        • SHA256 1b43f2e52c4f809a56b7bd6bc1e75de9c1cdbefc8e1a1e9123b924a2c0aceb1d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javafxpackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
        • Size 6.2MB
        • SHA256 6deba047e9bbe2aeba4589b70e73c33c7ae16d0cd88422ea61f4bd9f5ec2f4a5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javah.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
        • Size 6.0MB
        • SHA256 5dbbda96f5e8eb63090766ee5e05376911e9d6db762b4bf05e3c0a23addf744f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
        • Size 6.0MB
        • SHA256 2e56d63a725291b147a204d9a5ef3e04474201828a19a9e7009e8b8666ffe653
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javapackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
        • Size 6.2MB
        • SHA256 07682a3118359f082c8bce7d008db726ae44f23a9c29da2cf39a1946ef528c00
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaw.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
        • Size 6.3MB
        • SHA256 5ad186445adfe176002ab61eb035a60a4745d1fddf35dc0bb122a17692b7c069
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
        • Size 6.5MB
        • SHA256 3dae4bd1b7507178b9a0f494a263ff936412d07c2fc8f2a2bbe0d0829b7795e7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jcmd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
        • Size 6.0MB
        • SHA256 af02e2ece636b09998d40477e6a49d35d42a12c8b40f270f0b9796f50fc06997
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jconsole.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
        • Size 6.0MB
        • SHA256 f541ad2dd593abd38144f29618936b44028c958736ab4030ed18b852ed2f704a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdb.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
        • Size 6.0MB
        • SHA256 02f3277b7afee2d1ab007dfa3c3ebe691c39b8122feb4cedb0f55d80e83d0380
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdeps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
        • Size 6.0MB
        • SHA256 3f99248bab29f0799ca94219a42cee57fda35e1cebc086b81b5c386979441092
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jhat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
        • Size 6.0MB
        • SHA256 0cb434d0ec35e104acc4781018def2856730638bb74a36db9995356e0e192b0d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jinfo.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
        • Size 6.0MB
        • SHA256 a52f57fe4523237d72214637730a79016acbe986e29a764fe039efd8dc2ea6fa
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jjs.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
        • Size 6.0MB
        • SHA256 fa8ae0f5763f8f28c4b31ca5ba9849301fecf112ed4e83afc3abaa618c2cba58
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jmap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
        • Size 6.0MB
        • SHA256 d0d18976bfa0f5d99f9ef2749e6e0e38a5aab2845cd65c908e6a8a0459d3693b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
        • Size 6.0MB
        • SHA256 1440d8200d844b22a5d59756549e04f1b7588b4454158ccb4d7625f9dc194aea
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jrunscript.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
        • Size 6.0MB
        • SHA256 3ab3de22e59e980925b245a71f4ab0c99495f46d2b97d1d440c33053c43edacb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jsadebugd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
        • Size 6.0MB
        • SHA256 7a33c38b5aeff440d36e07da85a74554444c641123f257e9c1bef51acbaf666b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstack.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
        • Size 6.0MB
        • SHA256 4a9b06751c27f74cd0bfac62d7fe6e5ef408947ede987664aa4c7edf44d1582e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
        • Size 6.0MB
        • SHA256 879545f06e5419fc69f9cd395941d669282b23a45fd344ea4a5d01cb9cbbf023
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstatd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
        • Size 6.0MB
        • SHA256 b3ebda546d98d112542776e2af1a1b0f5ff3f497a3662ac3ead6c2e1655d1db9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        keytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
        • Size 6.0MB
        • SHA256 f386caa6ba73e27972ee31c3920f791f069c3a731ab0955e76460641bc85040e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        kinit.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
        • Size 6.0MB
        • SHA256 be50eab5999dfd01563c07100689c885546adb0accdd9aea6e8f255f201396e2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        klist.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
        • Size 6.0MB
        • SHA256 daee7c7ab190ac6a1507473cfb087b4ebae74c6d368fcdae36ece1f6218a3b17
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ktab.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
        • Size 6.0MB
        • SHA256 28bd3f4e7e76c45843b73f3da7d8a836178b37930d8caadc7854565d266063e2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        native2ascii.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
        • Size 6.0MB
        • SHA256 cc484fd56c323c478ea23c72498c737ca4018ada412ac2d4a4804af45d72d5fc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        orbd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
        • Size 6.0MB
        • SHA256 9ff81389ff89445084d96b1dc6bf57df662bd8f2c6483f51be697f72c2dc3e11
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
        • Size 6.0MB
        • SHA256 4cd96b891650efdb4bd31385a94b150133c5d392930047a5b54ad92ff181980b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        policytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
        • Size 6.0MB
        • SHA256 1f12221baefe8b8d39239557d5a8d1371807278235d7e54ba2d157766bb14ef5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmic.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
        • Size 6.0MB
        • SHA256 fbf0975be33abed5f0616be0465919271d6475ffd08ebadb0986877140d474d2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmid.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
        • Size 6.0MB
        • SHA256 8ce0cec7dc2a600f460f4e08b2a765acb035019ace4dc8da2bf320c1d8ada72c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmiregistry.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
        • Size 6.0MB
        • SHA256 4b5eee50ba4241f5c2d7af93dae8f4fbe96c92556e31901e8bf071a856d4f259
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dotnet.exe
        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 6.1MB
        • SHA256 625bada8df82054a988e9f93e8ea3dc062d0dfa39dbd02335174687aa9e1e47b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 6.1MB
        • SHA256 cfc6af0fa797df11c159efbe7abaa07eb86d0a89897c3614890e4f43b15296ea
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 6.1MB
        • SHA256 5d19d136f62da80d055fa1865ca95c22a7a6253ec1935bec48c6ce7a87f9ebf7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 6.1MB
        • SHA256 1867a8c7950ee9588fd96e2d69f0d9597fc46ee0eed3051b7faeab21e3492ec6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download