Overview

overview

8

Static

static

3

2026-08-10...ar.exe

windows10-2004-x64

8

2026-08-10...ar.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    151s
  • max time network
    140s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260710-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    10/08/2026, 06:49

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-10_0676d21a7fb3a81f2ec7ee2d1ae2033e_cobalt-strike_elex_emotet_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe
  • Size 31.3MB
  • Sample260810-hlvpcstbnb
  • SHA256 e4805a810c89316b22905c55681f1b6b4eb5224efc56dd4431df7d86c2ae460e
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
defense_evasiondiscoverypersistenceransomware

Malware Config

Signatures

  • Drops file in Drivers directory 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Sets desktop wallpaper using registry 2 TTPs 1 IoCs
    ransomware
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies Control Panel 2 IoCs
    defense_evasion
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-10_0676d21a7fb3a81f2ec7ee2d1ae2033e_cobalt-strike_elex_emotet_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-10_0676d21a7fb3a81f2ec7ee2d1ae2033e_cobalt-strike_elex_emotet_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:3376
  • C:\Users\Admin\AppData\Local\Temp\2026-08-10_0676d21a7fb3a81f2ec7ee2d1ae2033e_cobalt-strike_elex_emotet_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe
    C:\Users\Admin\AppData\Local\Temp/2026-08-10_0676d21a7fb3a81f2ec7ee2d1ae2033e_cobalt-strike_elex_emotet_glassworm_hijackloader_icedid_njrat_remcos_vidar.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:2164

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        AppVShNotify.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
        • Size 62.9MB
        • SHA256 79d2ac7a8f90a517398ceede336da8ef8d92d86aef08975f0139f4e4a14dc5cd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        InspectorOfficeGadget.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
        • Size 62.6MB
        • SHA256 b947b9f65b3148ff5b4b1df0b1b2dbbc6e32a079dc693904713df7dd9f8b708f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        IntegratedOffice.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
        • Size 66.7MB
        • SHA256 4ae34574e6a8ccb3475ed4756f146ffe3c7813b324fdd7fd70e6e1ecd43443f9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MavInject32.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
        • Size 62.9MB
        • SHA256 9d8ece9be8dccbc2a2259af49107af134406035169d44a439569731319a2c1b1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appvcleaner.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
        • Size 33.4MB
        • SHA256 c41ab1756478fc70a68a906ea9eb577241823645c21bc1e65e1338caedd8ebd0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VSTOInstaller.exe
        • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
        • Size 62.7MB
        • SHA256 e17efc06b278ecdc8e3e1ffaaca925e2362bb6aeccd2a005556785c26533cd9e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        setup.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
        • Size 68.6MB
        • SHA256 759d197df1e65f9511846f12891c229f9fa3d009787a0b643b42504d3a88abff
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_pwa_launcher.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 64.3MB
        • SHA256 891531c30de73441d020c58c33c9ce95049156df6fe512796556714909e247f9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevated_tracing_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 66.1MB
        • SHA256 ef49c9149c2e1ecc6258e7ffb2c20bb105a69908f7792da1cf3e3bcb55441180
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notification_helper.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 64.2MB
        • SHA256 1d3ad9880ea6c5ee019cf410abbf410e668d0cc647cd5959032ecc72ba73d02b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        os_update_handler.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 64.4MB
        • SHA256 25f92002607bc01709c6867db0435af1fde064cf7467ff47a0aa8a87e37d728b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 65.7MB
        • SHA256 806856834462063ad2b05421e31ec47141d2803521c39114abc04519256b17a8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_proxy.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 64.0MB
        • SHA256 fe05ec15cc97f8133f20e664b539b48b807e68d1205336f91f818603230135d4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        GrantUnpublish.exe
        • Path C:\Program Files\GrantUnpublish.exe
        • Size 63.4MB
        • SHA256 356c9a4f4c1e00c8d5bfa4bf2ea7e17f380bdf7f96743052f9a236f1313599a2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 1.1MB
        • SHA256 9230f966255fe7166fa86ee7c53ebccb6c306b75bcc69d3fefd9cbbf0ccc1a9d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 62.6MB
        • SHA256 802a880c6aa084193dbd8899efc60ccf682902b22b3ecec04d292bc09bf230e4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javac.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
        • Size 62.6MB
        • SHA256 9a918e57171eded5b36198547d5f7f090b92e44c263f4544d48b7728629d329f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javadoc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
        • Size 62.6MB
        • SHA256 18a3b845e8d086fdc2a2b47c530791e0327ee1b0bacbd835a7556458eaa6c979
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javafxpackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
        • Size 62.7MB
        • SHA256 6b5428257f2cd37aaf2f29d5948c24fc579eeea991e9c52d88e64fc410e87fe4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javah.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
        • Size 62.6MB
        • SHA256 52751a69a486ed83bbb8c9e092e9a1cc5aa66bf2a3694141c5d9d05072184a12
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
        • Size 62.6MB
        • SHA256 065107a7b84e17683eb243b32294b95286a0d9ed190dc632f3131a0035fae17b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javapackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
        • Size 62.7MB
        • SHA256 a65b451d75f8c0dec83f6282ca1b5ce60a78a792bbc9974ed819ddc1dfc15b2e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jinfo.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
        • Size 62.6MB
        • SHA256 a0eae5ef7c8fb333b6e28c6ab2b1aab5756bc64b278584533e26db2e446f0f63
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jjs.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
        • Size 62.6MB
        • SHA256 58a9ffc45fe4d687526e1c06d937cc5895623b0294e533b014355e58c8d4b046
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstatd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
        • Size 62.6MB
        • SHA256 2dc84628e1cd128e2fd9beb4112070bec4a77890b8e88f5912a6319aea38b85e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        kinit.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
        • Size 62.6MB
        • SHA256 15d42e1d9b2284ceb0c9248f0926322cc0c7ddf0bc3f69fc066c105e3d947e50
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        klist.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
        • Size 62.6MB
        • SHA256 a762ba43b637e85eace67e8c271c055f33c2892015baa28245216da947a1df67
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ktab.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
        • Size 62.6MB
        • SHA256 55675b4dabbe3468376e9e5fdf939c5c9f1eb2a558f989e8c81dc2db914ebe20
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        native2ascii.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
        • Size 62.6MB
        • SHA256 999fd0cff94740315b1a7cffab93c365676ad850198c258307e07c7e7608e099
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        orbd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
        • Size 62.6MB
        • SHA256 0834dcb21a4ee4e2c2fbee1918b611c181ca618239bae22354d4b2df3281c053
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
        • Size 62.6MB
        • SHA256 30508062669d1bda76a0f535bea9c7fe60d310d9b35703daffc9149baffc2a63
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmid.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
        • Size 62.6MB
        • SHA256 9ac94f7ff415a6efbe61ebee0050f75eb3bfedc9b2b43dafe832fabd71c93920
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dotnet.exe
        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 62.7MB
        • SHA256 591a6160d3322b39a36010e9b1c63087164ba73a96430ec3cd8476147df5fd9a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 62.6MB
        • SHA256 ba676376e46d8490d8d1bedae8abd36dac9f21e40601d1f69d78e60517101e61
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 62.7MB
        • SHA256 a6c67b1f9353b6f9cc6c50e4e22e90c6a65f1dc5b72dec1e1ac0fdc50fd824f7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 62.6MB
        • SHA256 7c2f3ea0762d18748cba76e7f07fc93304fe28844615aeb2d175082513a97662
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/2164-12-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download

        memory/3376-0-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download

        memory/3376-1-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download