Overview

overview

8

Static

static

3

2026-08-08...ar.exe

windows10-2004-x64

8

2026-08-08...ar.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    149s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    08/08/2026, 14:36

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-08_4d81d3e4a96926281c821f7172571317_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
  • Size 10.4MB
  • Sample260808-ryxtxsea22
  • SHA256 8f169a10cbdeb50a4d7f3e36dd7de62d59051efd874bb09f08074be282f134b7
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
defense_evasiondiscoverypersistenceransomware

Malware Config

Signatures

  • Drops file in Drivers directory 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Sets desktop wallpaper using registry 2 TTPs 2 IoCs
    ransomware
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies Control Panel 4 IoCs
    defense_evasion
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-08_4d81d3e4a96926281c821f7172571317_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-08_4d81d3e4a96926281c821f7172571317_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:5408
  • C:\Users\Admin\AppData\Local\Temp\2026-08-08_4d81d3e4a96926281c821f7172571317_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
    C:\Users\Admin\AppData\Local\Temp/2026-08-08_4d81d3e4a96926281c821f7172571317_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:5984

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        7z.exe
        • Path C:\Program Files\7-Zip\7z.exe
        • Size 10.9MB
        • SHA256 22d87e9b6588a7e0df701c0a4e0da956716b6d8649660215ebeb8306d4fe3416
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        7zFM.exe
        • Path C:\Program Files\7-Zip\7zFM.exe
        • Size 21.7MB
        • SHA256 7502dfd2557e12836ad0ca60e20ebc2866a154fbb824ebfcc8e6252e858fb283
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        7zG.exe
        • Path C:\Program Files\7-Zip\7zG.exe
        • Size 21.5MB
        • SHA256 fc7dc40437f1c3569cbe6fce4e813cf82264bab72987a3de4a1daa9edbe715b8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        InspectorOfficeGadget.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
        • Size 20.8MB
        • SHA256 21e8f5f28e1391b3689cf31a9c6697e50f9203dc527fd1975f4013debc7c7afd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        IntegratedOffice.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
        • Size 24.9MB
        • SHA256 515d93f246f0fcac27e957f82d74beb5b323b3e20697f118c97f0217f9e63839
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MavInject32.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
        • Size 21.1MB
        • SHA256 418f354de15ee97ad582aae186c8392bbc62405c9a013b86a1342b57551aa72b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appvcleaner.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
        • Size 22.9MB
        • SHA256 7649c80b77d55fee5cbec09ad6975d527b27d5badbad9f7b92bdcbd31ac405de
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VSTOInstaller.exe
        • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
        • Size 20.9MB
        • SHA256 cf107247a71cf289208ef1ea5dca571ee3f3ecd21747d7a925a7a023d1f03e4d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrmstp.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        • Size 26.8MB
        • SHA256 377b45ad51179889ca8017ce7a3358f829c278475227cf99aee1f28c8049889e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_pwa_launcher.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 22.5MB
        • SHA256 712ed86b5a1fe94cb4a20d2f7fe55993e6c2a9ab7a2421f2f51504760afeab6f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevated_tracing_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 24.2MB
        • SHA256 e26a9c9910b509aeeaf66c76055a306fdc4978a87583f46387143b297e5ead3b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 23.0MB
        • SHA256 b1d2ac8cc4d44a6202aab199057fa48aa190dcc58b75f622c4a8c6c038fad8a6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notification_helper.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 22.4MB
        • SHA256 7d05a9387d1705fd5c06aa7d48a01e6d68ed038b85747cdb012f700fb97a0265
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        os_update_handler.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 22.6MB
        • SHA256 03af23132c7307baab5018c25dddf892fecbe4f699829ef41307d863cbc7ffaa
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_proxy.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 22.2MB
        • SHA256 cb9c06b2bc35c3721d5e06765f1561fd38d6ad12a14f8969ca1035f099de727c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 20.8MB
        • SHA256 354b7fac1b5b1b8b4608a722d99d5c13dc34f9cec6902a3e0679e39276fab3a0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 20.8MB
        • SHA256 7ba36ce8f6712d9d8085e8d1eccbd712373858243d2ff59343dd516675819cce
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 20.8MB
        • SHA256 e58e4ffb175b28d80ad0c3ae2babf4e2bb5d1dc475c9e183c4f7e550ff90cd66
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 20.8MB
        • SHA256 1bf2ea0cf31fd06ae9c0ebcf97b506f110bd95f9d7565affa0ffd963fe89def5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jar.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 20.8MB
        • SHA256 cff909bb911a224b11c3f66dc09c604bffc71459eb105dd88dd9b7195f49cc65
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jarsigner.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        • Size 20.8MB
        • SHA256 7e39bde2e584aac8629c4c105d857a6ead0c8ab218c410b9f9184c680c21aab0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 20.8MB
        • SHA256 7390945e5fdd2794c43f25d1de31fafdb5d831ce61260ebceeda711d2f8c1a20
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
        • Size 21.1MB
        • SHA256 3a422d871c3203a5ce9ca86b5ef12651d13ebfa6d08823e5b7c09c159f35946e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javac.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
        • Size 20.8MB
        • SHA256 b7fde57886704318a9b2b8c82d31cd287c457ad1d67550bd840ffb58d730104c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javadoc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
        • Size 20.8MB
        • SHA256 e2b00940cf523600503696e4a9a7fc6a1e800687f4755f5cfbd111cde3922fdf
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javafxpackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
        • Size 20.9MB
        • SHA256 4664c6d629bb91443d1026e87b289a680894d09c7c97c89887c116e2fdd4860a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javah.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
        • Size 20.8MB
        • SHA256 8ffc9173b2b4d168299e41bba3323491122adeed270c1e3ff5b4a7f30bf8f04f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
        • Size 20.8MB
        • SHA256 12ec953ebfab1934eb3f7d53c04a017814cb95a4a82d5a87706b5b07c89d4c34
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javapackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
        • Size 20.9MB
        • SHA256 d21b43ddcd663604423e2dee1befd4b8829b8d85d6a6c5dac78b0cb1bf537cb3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaw.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
        • Size 21.1MB
        • SHA256 7eeee8cba16a1327e8006c07a9fde0212594a7d7623d1a75964268cf05a133d6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
        • Size 21.2MB
        • SHA256 c46e99bca992f57337df4f6b04d00c9a991ffff963836f628faf4a366106468d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jcmd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
        • Size 20.8MB
        • SHA256 6e35d5f8d3d8ce6176b3c185c62802a8e9d846d3fbb36d8f56d52034ff26d2f2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jconsole.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
        • Size 20.8MB
        • SHA256 9b6236ae487036b6827e40b6df89a33c546cf7bde19affb4f176e89e9862c28f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdb.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
        • Size 20.8MB
        • SHA256 1dfef572684a533ea50c420f2a9acf5dbc35ca1c48882724f54620df136a232e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdeps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
        • Size 20.8MB
        • SHA256 077f9e6bd87091db9d98fa13448393c8d7a123ce32e287b8e0d0e1af3767e192
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jhat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
        • Size 20.8MB
        • SHA256 3bfc24ed5f9d902029f503d844b14fa2a15177f329bfeef38534cbd4c53d348e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jinfo.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
        • Size 20.8MB
        • SHA256 2f3cd9859691f959b149fbda8aa7d7edb4b9d89ae7b5b20940756ff26c1b7553
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jjs.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
        • Size 20.8MB
        • SHA256 81dcaeeba4cfef8c4bee669b7f93a397483571fe37dc90ffe7a1255b23faeb83
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jmap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
        • Size 20.8MB
        • SHA256 263a515349e3719b2bcbf393f95bc78ee83a7373fed5b5e64737e03d093dd9b6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
        • Size 20.8MB
        • SHA256 73ebd104ad6273685181b882e611c570327c7879a2324913ba1d585ac07779ce
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jrunscript.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
        • Size 20.8MB
        • SHA256 e12845a9d1e758449f390de1a481944d57152d76709ae3e30e045146e89cdd13
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jsadebugd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
        • Size 20.8MB
        • SHA256 30c53400cb37a1ad6b7232d8c028411c5678f102ef40d8189612817826bd023a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstack.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
        • Size 20.8MB
        • SHA256 19d37050f7cb36eb64c63b74507c4e39b38696e702d25c9875e056634cf2f4dd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
        • Size 20.8MB
        • SHA256 97e471e22c3bc4c2a5e064c64ca35cdfca2c0cf4ec7a25d6b3bd7fbcdae31de6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstatd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
        • Size 20.8MB
        • SHA256 388d72a1418637ad121d07b31e766dd8d455eef87c885ccedc844687b988eefe
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        keytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
        • Size 20.8MB
        • SHA256 cc4c585ba99fdea67ab8b81750a2ca7e89b21284665bbb70ea77588f45a3eb05
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        kinit.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
        • Size 20.8MB
        • SHA256 457a16df53a43095577d1539fbcf52931ef05340d4ea115d155488e68ff827ac
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        klist.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
        • Size 20.8MB
        • SHA256 58d0d828f5724225e56ac8f6e14fbcf88a72b557b2951da8c33e9eb7edb34b42
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        native2ascii.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
        • Size 20.8MB
        • SHA256 8a7e853260367968e94bbab9e0f8b305c7daade30a413f913f99e1487e2bc8e7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        orbd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
        • Size 20.8MB
        • SHA256 fcd175e6e3276918cb657ac7c082be18aebe2cd61d16ef7ff01296135faed950
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        policytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
        • Size 20.8MB
        • SHA256 40aa74a72cd5a5909a85bf3260d58059371944e26d1fb94546f8db87725a0e56
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmic.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
        • Size 20.8MB
        • SHA256 a1228aa205f910e1f958ae959696603dabadad55c55078cba72f6cb9a6b6c8c2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmid.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
        • Size 20.8MB
        • SHA256 10d3a515acbe33de02a9e3749308101778667ce1b45a0a5b4da298415d52a86c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmiregistry.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
        • Size 20.8MB
        • SHA256 ec613d1ba5cb3fdf7c93039876a535ae26be6cb7e1f89eb011366b90c1bd4415
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 20.8MB
        • SHA256 6db2610ef7bcacc8a0f1ac67479ebe1954bbeadfc896cfe7f2094b5c8846d558
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 20.8MB
        • SHA256 929a895508e22081f6060b6be6b17c819a0814926dacc421e7e6be74c8880e01
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 20.8MB
        • SHA256 5f2e816c498df8f9cf2d593041cfc40d949efc29c38c6fee9b37c1b5c9f411ac
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download