Overview

overview

8

Static

static

3

2026-08-10...ar.exe

windows10-2004-x64

8

2026-08-10...ar.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    150s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    10/08/2026, 06:05

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-10_91f1acb5078393110510f1268ce4577b_cobalt-strike_elex_emotet_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe
  • Size 11.0MB
  • Sample260810-gtpbwacl5x
  • SHA256 007082a464cad13265fcaa853ab180c6003e938648aed86adfbbcccfe6502c55
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
defense_evasiondiscoverypersistenceransomware

Malware Config

Signatures

  • Drops file in Drivers directory 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Sets desktop wallpaper using registry 2 TTPs 2 IoCs
    ransomware
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies Control Panel 4 IoCs
    defense_evasion
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-10_91f1acb5078393110510f1268ce4577b_cobalt-strike_elex_emotet_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-10_91f1acb5078393110510f1268ce4577b_cobalt-strike_elex_emotet_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:3956
  • C:\Users\Admin\AppData\Local\Temp\2026-08-10_91f1acb5078393110510f1268ce4577b_cobalt-strike_elex_emotet_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe
    C:\Users\Admin\AppData\Local\Temp/2026-08-10_91f1acb5078393110510f1268ce4577b_cobalt-strike_elex_emotet_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:1140

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        7zFM.exe
        • Path C:\Program Files\7-Zip\7zFM.exe
        • Size 12.0MB
        • SHA256 72b91ecffab2655d92013e05381433a245389fe2604976477b1c0657677e698d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        7zG.exe
        • Path C:\Program Files\7-Zip\7zG.exe
        • Size 11.7MB
        • SHA256 777dc4840bf926245b82ee09ba07773ccc55f161ab1beba1b418dd4283461a61
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Uninstall.exe
        • Path C:\Program Files\7-Zip\Uninstall.exe
        • Size 22.0MB
        • SHA256 1ca5e185d8948bff170b8c8925e9aa7e7d692d45102f0d5fcc2cafd25bb0d256
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        AppVShNotify.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
        • Size 22.3MB
        • SHA256 e7faa60d1793551c3caf4153a58ac953494fd8bb45b06eb648977f7d4b00e0de
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        InspectorOfficeGadget.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
        • Size 22.1MB
        • SHA256 1a803a3799737dcd95930479f84d2409eb37b36e04a69692318612b2a018d85a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        IntegratedOffice.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
        • Size 26.1MB
        • SHA256 f0def90dbaa79ffeaf116bc9661623e4a7d39d1d0e48ba4a5de26e5ee33c3c93
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MavInject32.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
        • Size 22.4MB
        • SHA256 0d79ae93c565201818eb106bf318d6a0d3e5efd2feaf55cd8cc02a435df07252
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        OfficeC2RClient.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
        • Size 45.5MB
        • SHA256 20376953faa4b658147a48c471fec9cf11c4e157ab08cb1f6ec93304d63a3d23
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appvcleaner.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
        • Size 24.2MB
        • SHA256 3b2fbded72fb50c186f7eeac352858a0a53d9390520f13b8d89a633c5828af57
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        DismountMount.exe
        • Path C:\Program Files\DismountMount.exe
        • Size 23.0MB
        • SHA256 f11de752fcfbed6e1363b86e5889efd7704486d7e0038fb6cd7417c437a04ff4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrmstp.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        • Size 28.1MB
        • SHA256 444a9fbe2849edf1cfe8e83c8b4168ef8db485569eba37a329b352224f265e66
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_pwa_launcher.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 23.8MB
        • SHA256 889b20e8fe84745ff439c3d4774b7b538458715393ca013e1f3c58dd623b47f8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevated_tracing_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 25.5MB
        • SHA256 f3e578c9ec8c482fae3f2b614be4327d8a9f584d1477a6c3d7c9f01ac52399cb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 13.3MB
        • SHA256 834f9b3074967b8f39669b22c36171d6e02ddcefbc42ea13376c35711e272db2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notification_helper.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 23.7MB
        • SHA256 8d03a39ec710ed8c0a219fd250810170fe9fbd376448dcbec2cdc58171aa3a4a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 25.1MB
        • SHA256 9ba2a081dd5171763aa5f851d84b898d89fa7d85dad487a1c1e945538cbccb7e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_proxy.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 23.5MB
        • SHA256 892bdb0ddc73ec89701489088cacf73d6c35105bdc452aa8df7aacd24a022ff6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 22.1MB
        • SHA256 36e784e058bfd1df21b252513ed80b8ba256ded16f664d97c8765922730119bd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 22.1MB
        • SHA256 551c3105d79ab7bb72d5b4141d10274f6042d9de4693568e46227357aa698c9d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 22.1MB
        • SHA256 355bb0b8fd4097d85a087f9cda2aabe25faa7ef0a39b098e6bf95bc3692d9f9c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jar.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 22.1MB
        • SHA256 6343c422c0085dedd6003ee4f9c5a6d97b239f297b2bc6da4c9a3d6374c82d8b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jarsigner.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        • Size 22.1MB
        • SHA256 dbd35842e14d2abc14dd27505ed6a2d9b136a8a13bb605ffa6ceeea52d0e07a2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 22.1MB
        • SHA256 e2ecf4c2179df67ae71bcad05944cef5fb43154adfc6168b1b7dc03624c99248
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
        • Size 22.3MB
        • SHA256 a8d2b3a87bd1368e597e69dcd0a224b06cd556ea7c3833f78c5dd16d4625bfef
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javac.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
        • Size 22.1MB
        • SHA256 cd4a1856737770abd74d3ffb7da958266bc90721f9e51a5b9bdeea43e0f0af92
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javadoc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
        • Size 22.1MB
        • SHA256 89615d56b29b6fb0e1ca4ecc845d90af1f87456473e0b4178118114373aca00a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javafxpackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
        • Size 22.2MB
        • SHA256 eed0f6ec3938986777bc8de0e44b1d6f4a74455d7b6ce39d9bc3d42d35d23345
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javah.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
        • Size 22.1MB
        • SHA256 9fb8fb7961458ffcae63e569510a812d3f613683b25c875f3664ed6ec83520f0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
        • Size 22.1MB
        • SHA256 2a42a5147853a949f5bc14f11b16ee60d4c0318d2d62d5f428e1b7d24f082fe6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javapackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
        • Size 22.2MB
        • SHA256 9559320ba6b5518eef212dea8c213518b172cf57ff42ddbc38e2c164cb397023
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaw.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
        • Size 22.3MB
        • SHA256 1a2b14f7b1afb26dea2bdf8581c4fb80af132fe6fd70656f1799f04484a8d10f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
        • Size 11.5MB
        • SHA256 3d533a2cd34871a2c880acba18de4e94fd3495ddc4661fa07994020d27c720dd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jcmd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
        • Size 22.1MB
        • SHA256 6821edce2e4ec8b165e1f086b6af89c09a66a78fe7f7e533e2362ea00fca37f4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jconsole.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
        • Size 22.1MB
        • SHA256 0571283a68ee3c23377434825d18ff3826b8d7d0bdda1f5b98dd5c57e1a9f8c6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdb.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
        • Size 128KB
        • SHA256 e52488a8a3c5c15a2f928eb2127c84d20ca0143b2598bd3c627a271a6a7a3d72
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jhat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
        • Size 22.1MB
        • SHA256 f9d3ee4b1cab2155f450f3f6c07a366616614a9e980707cbc722026b026e4ae0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jinfo.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
        • Size 22.1MB
        • SHA256 b2558d6c2f9e3b73f84eb9ca0cfee84dff0d87f0aa7b449491e0ef900fecfd43
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jjs.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
        • Size 22.1MB
        • SHA256 9937b7c1e7f00307d5e20017cf323991aec60758f0ad989bc9d7931435d5e9ee
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jmap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
        • Size 22.1MB
        • SHA256 6c180143a96531539d6ec388268951743460cc3a999fa1dfea88cafffd01ad72
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
        • Size 22.1MB
        • SHA256 af28f22f346bdf9ac8f7b52b90a033e302af38d2a2cb85beeefec5dac8424c90
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jrunscript.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
        • Size 22.1MB
        • SHA256 5a08e5a4d7fb7acbac8b3b86ff7cdacf3ca64c4f0537d1b33190671d91f3f674
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jsadebugd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
        • Size 22.1MB
        • SHA256 d4cdcc4bb5fb6c11d0d014d6b8c6afe82e31e50ad7368ead28f65a50c74d0db4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstack.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
        • Size 22.1MB
        • SHA256 852e48fd0ff175a7b126889d5317c76279f7688e84cb7fbdc88734cb4b6c8ade
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
        • Size 22.1MB
        • SHA256 9298db97353ee04e0e4ce13b842a3dccb2e1eb38e3e005c8679397e7639fdbb0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstatd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
        • Size 22.1MB
        • SHA256 24645e224216893e05475ffc509e087cfce234a986e2ba549b389387df9e0e99
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        keytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
        • Size 22.1MB
        • SHA256 8b6a3de85aa9abd5c7fcdc8d16bdff89c93445e9871550f9e38b768f9e4b0062
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        kinit.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
        • Size 22.1MB
        • SHA256 47645ffa8bb35b7a64f01bfec61329436e59a7d1cc331265204028637ca3b080
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        klist.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
        • Size 22.1MB
        • SHA256 bc586e9c32095abf6a4c92329f0a8f404340dd7f6b9fe690e7c078475a7f58f2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ktab.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
        • Size 22.1MB
        • SHA256 6cd847d2933bf576d19ddfec91e261dee756c67f1484605ecf12749158171175
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        native2ascii.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
        • Size 22.1MB
        • SHA256 6150e66bdff14be80a2299082cf4725f41fb1b90cf6c4eecc337aa073d3a4cf8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        orbd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
        • Size 22.1MB
        • SHA256 3dd41f049ec7e1a4f70d3d137144b245caf09d3936d5ebe1e4fc70d6618d832b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
        • Size 22.1MB
        • SHA256 4b9f247919244ad813a4593af8b5cc7b15844508ff4dab5c95677e4b05c64633
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        policytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
        • Size 22.1MB
        • SHA256 01593b4b9ab7c0072a8b3d7c7dffa03f6cf26a82311d4c70512c38dd5eadda23
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmic.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
        • Size 22.1MB
        • SHA256 a466d8785aad47e1e2e034375b10221acd4ab5fefd3c0cbbc30ae7bf46da1c7d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmid.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
        • Size 22.1MB
        • SHA256 e68a20687574a76d11ed92f9697fa3284d595748d51f47e682ca400ca889b536
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dotnet.exe
        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 22.2MB
        • SHA256 6224813f67df7af1ceb5835aa39f9c6cc8d922833cba088cae6c1b9a9ba3ac1e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 22.1MB
        • SHA256 a0890823ed1cfa648f8bc522f2a998fc363644bfca472ef038942dc4942000de
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 22.1MB
        • SHA256 8c9f0c0f8893133a4cd4a802558d0f1b0a13048aed010d02b936ab2f21cd8dde
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 22.1MB
        • SHA256 d59118198f8d95a3025771e100c036ee5d755df3c02913e74de5e0491febdf7c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download