Overview

overview

8

Static

static

3

2026-08-08...ar.exe

windows10-2004-x64

8

2026-08-08...ar.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    149s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    08/08/2026, 17:21

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-08_ba34eac65388e36ad9cddb8f129548e8_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
  • Size 10.4MB
  • Sample260808-vw8p7a1erc
  • SHA256 e2cafe630a8fb14607a215bfe72c53747b1f0d70282f8fbab1bc124e1b2b72d1
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
defense_evasiondiscoverypersistenceransomware

Malware Config

Signatures

  • Drops file in Drivers directory 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Sets desktop wallpaper using registry 2 TTPs 2 IoCs
    ransomware
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies Control Panel 4 IoCs
    defense_evasion
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-08_ba34eac65388e36ad9cddb8f129548e8_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-08_ba34eac65388e36ad9cddb8f129548e8_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:4600
  • C:\Users\Admin\AppData\Local\Temp\2026-08-08_ba34eac65388e36ad9cddb8f129548e8_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
    C:\Users\Admin\AppData\Local\Temp/2026-08-08_ba34eac65388e36ad9cddb8f129548e8_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:4840

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        AppVShNotify.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
        • Size 10.7MB
        • SHA256 142c6d819550c80530ed6aa769929dc18493db30fdf071ea24262816e041392a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        InspectorOfficeGadget.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
        • Size 20.9MB
        • SHA256 6b90738ce303a42b1ff08578fd32536afdbb61d93e0bf33dbc2b1961e8dfab24
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        IntegratedOffice.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
        • Size 10.4MB
        • SHA256 e2cafe630a8fb14607a215bfe72c53747b1f0d70282f8fbab1bc124e1b2b72d1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MavInject32.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
        • Size 21.2MB
        • SHA256 4fe24bb79628001596b0ff6b576b504c8d2a70d4e5b0ad1027d64644d5aa1d99
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        OfficeC2RClient.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
        • Size 33.9MB
        • SHA256 a6a60383ae0ab5a317a5041028a778ba40d22a18594f41f78012e22b612f5197
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appvcleaner.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
        • Size 12.6MB
        • SHA256 0d924b62fcb70ea74cffcd62b3f03cfb12b7a4c20b8fbae4063a200bfe96d98e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VSTOInstaller.exe
        • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
        • Size 21.0MB
        • SHA256 844af298e860975efb7ba9ed59f9db3c84a31ea80226e26078417803c61a9b12
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrmstp.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        • Size 26.9MB
        • SHA256 6fed2816e42ef970e7d6d70e2cc9ccf1f86df3fffa81d793fa9fe1fc46441a30
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_pwa_launcher.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 22.6MB
        • SHA256 b07bd11f07c222b66f15038af41201bbe57e763e8285a11a3de64b6c8a060476
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevated_tracing_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 24.3MB
        • SHA256 ff6e0af80dd1cfbed7299e3311909bb32ce25881a9a20156440218ee34a88bd1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 23.1MB
        • SHA256 47f92ad074b2d628290f554517a5f69e6421c6773a7c047a1d8ce85537e23d0e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notification_helper.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 22.5MB
        • SHA256 813578c42a0819835b4b2655988b6cb672df22b3bcf5187509ae495b5821e4eb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        os_update_handler.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 22.7MB
        • SHA256 395a8915a7baa0249b7489a572d4a184f30919c7981bbee50daadabfa5547a0b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 23.9MB
        • SHA256 f8ea60814705c20e5b8da21b313f88f3ca69938c0dfa66e305e875a894ae9b6f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_proxy.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 22.3MB
        • SHA256 a75c8cd2692b2586259ae71ff9340e70f506c8b9c56ee09dab2616219615819f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 20.9MB
        • SHA256 63d4db70a8cd85761e4fce9da7678efd9ce057878f566dfe625480fab4b7438f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 20.9MB
        • SHA256 824701d17360aed28b87beb58ff4f4d58bdefbc4f07d8fe3508a59d53a171bf5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 20.9MB
        • SHA256 bdbaa6a1ead01828fe51385b6bfad572c71fc3d79763289033cfc873cf7e0672
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 20.9MB
        • SHA256 55b407eb507b9123e40c385f04998e8e064a168130a1a8c04664a5a324015404
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jar.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 20.9MB
        • SHA256 829af4803c7980de7f38e85cf069ec0f4c50a0fa7809362ebc492a4c8147ef8b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jarsigner.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        • Size 20.9MB
        • SHA256 c28be4e424a577dc2cd49ef737be6362d21789ca7b309d0e557970f63b944980
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 20.9MB
        • SHA256 4a490eb670a391aff4933750747f4d68302c1ae5556c4bce1e1c56403a9460ed
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
        • Size 21.1MB
        • SHA256 321b07d776f49ab46eebda0ab2b0024f40545ee374ec69da160689557ae7da4f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javac.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
        • Size 20.9MB
        • SHA256 5dd790c1893d053f3f442dbf72940708b0bdf28b7fd6356a3e73e79d75a1fe7e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javadoc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
        • Size 20.9MB
        • SHA256 6453fa240a0b87ad34e42daa3bed631a61902fed6aed84e7c59f57891813b93c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javafxpackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
        • Size 21.0MB
        • SHA256 024ca1eda15fb52e7b5c7563e5d02ad6da1df0a0264613f300186410eb44d0b9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javah.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
        • Size 20.9MB
        • SHA256 790ceca5621c854017549ca68214c620a390fbb67f736b05a00a66b010482462
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
        • Size 20.9MB
        • SHA256 5f2f24b3c175df494c5de144d428c8a4859e97048751cfb7650be88a9951b206
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javapackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
        • Size 21.0MB
        • SHA256 ce57a35bb66d766826061fc390812dc72a0fd0757bd4e90fe1b1dc1411e9bf95
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaw.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
        • Size 21.1MB
        • SHA256 1bcec86d786e7f10f261dfc39a7a2dfb329c02c262e5af8e929729a525ab8037
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
        • Size 21.3MB
        • SHA256 13e609a5746fa077a745e1856d4e49924c7fde597a649b590983737bb4353f76
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jcmd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
        • Size 20.9MB
        • SHA256 2f20a14dc8960732ee5447af67b10e484d8db31a197650a060f76576fbc41952
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jconsole.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
        • Size 20.9MB
        • SHA256 d195b61af8c147ac30f964c58fe2d3e29343419bd56501032179c23b9ef36bf3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdb.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
        • Size 20.9MB
        • SHA256 229d646b0c1ed8f7ab40cdb67c4e59e8a3c8f733471c0b82030497810925d46c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdeps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
        • Size 20.9MB
        • SHA256 b7a6121f4f4617aa841249e8f44bcfd314f4afa2e3045c523824b94e70d00762
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jhat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
        • Size 20.9MB
        • SHA256 6cb3c53fda8d86d21b7e3576ec094e2b07469ae50c9621429221c4adc19e81f5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jinfo.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
        • Size 20.9MB
        • SHA256 42d18cc8d441b909bf7761b1797e19461402a4f6e514c2d0d23af1150ed10dc6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jjs.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
        • Size 20.9MB
        • SHA256 146da1a0edc4077fefb1c769a3e78b58577112e7992a4ce910761ec9ee4089bb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jmap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
        • Size 20.9MB
        • SHA256 a62aeefc761c073ccb65ca52f4d56a7c30c98550c87dbc2fce63e9a3e03b89e4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
        • Size 20.9MB
        • SHA256 9514391d57e6b508ec89845d295901d82190a30c3d7852f885604b6cf822f0b2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jrunscript.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
        • Size 20.9MB
        • SHA256 818166efd637a4b73c80957352a3f7d19ec929d9971b7b8c9bfdca4445013545
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jsadebugd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
        • Size 20.9MB
        • SHA256 d88631452955d7498832eddac2603e5f1d70731f029027f9919cf3b0a905d5cb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstack.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
        • Size 20.9MB
        • SHA256 e9971628b57aa31149c75dbddd6ce121faae399237bc147633617b70cffff72a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstatd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
        • Size 20.9MB
        • SHA256 ee06dd91953de90eaefbc019935558475bc1b3ec7b13efb4d54876ec8e659406
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        keytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
        • Size 20.9MB
        • SHA256 8efa6cb32cf997cf166df7c94f3c5d403191c97bc1041200eddd26ed22150204
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        kinit.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
        • Size 20.9MB
        • SHA256 0ea0e9ea71312f49cf3ec83deb15e45c803f59ed529ad6ccfe1a862f7978fe83
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        klist.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
        • Size 20.9MB
        • SHA256 a225cdf9721e5c8afa2dcd3f9cd20834f1ae2a501f9f05fb7376d082c426a423
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ktab.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
        • Size 20.9MB
        • SHA256 d7fdb581b3a6e71458fe38f01bb73df36e8f543a2df83ac21dde18f10f9f45cd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        native2ascii.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
        • Size 20.9MB
        • SHA256 7e2925c2bbe51238805490c0adda71aa0ddf753137706e04440cf2fe2711e8d7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        orbd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
        • Size 20.9MB
        • SHA256 6ac980a7e2f3c644dd4bf4bddadee83115ccd386c4b6d459e6bff9a21687c956
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
        • Size 20.9MB
        • SHA256 5e4875963dd6f5c291710458f23cea941ce817e810d1e21316c75c58c10e64ec
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        policytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
        • Size 20.9MB
        • SHA256 d0c40931d2d594139fa39383cbe1acf06530334c5cae99458cc4107529543764
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmic.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
        • Size 20.9MB
        • SHA256 545ccea9fc512e2a98fdcf0b1f6090bf79e9912b1b449b5d5332b6e1d4991c95
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmid.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
        • Size 20.9MB
        • SHA256 038109694b1a4287d1bbba23c4dc76da8d2e9af7790573a86517e3859d18933d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmiregistry.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
        • Size 20.9MB
        • SHA256 49818652b5cfeb5b73fad45723d87319101e4655b2bd0c892afffe87b9ac4361
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        schemagen.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
        • Size 20.9MB
        • SHA256 4b373103619d02e4517251d7b88a1146e8d7e1ee3c0f9ddd60b1daa141c96236
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        serialver.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
        • Size 20.9MB
        • SHA256 1a53960435bd9617cf42d0b952218604d881a8a1de14674a84fb4ce6eadf43ef
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        servertool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
        • Size 20.9MB
        • SHA256 f98499d6d123cb05d750f02accf7c968c04497ad8bf19cb87007cfbe278e8d31
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        tnameserv.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
        • Size 20.9MB
        • SHA256 98ac8a6489ec2e921ee5a70355454515b31c49993ce78895833b5d3b063160f0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dotnet.exe
        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 21.0MB
        • SHA256 a5671e33df441d4bdf0a0e1980bcef1c170055a504c5a1885e697701f74a9a8b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 20.9MB
        • SHA256 bf38129df8c7eb57f95ad2e98b3d4214722f06389698deb951db287a019aa9a1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 20.9MB
        • SHA256 84e04170180e241448bf9c4cafdf124d020febc2009fb0165fc5b5726c1a25a0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 20.9MB
        • SHA256 afb330951e53bf0e27d821287150a3d0660339cc5b46a7c86b1e65664b9b78e9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download