Overview

overview

8

Static

static

3

2026-08-13...ar.exe

windows10-2004-x64

8

2026-08-13...ar.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    64s
  • max time network
    114s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    13/08/2026, 04:29

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-13_7e2aa9c1ebefd53c339bd9a0f208a66c_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
  • Size 20.6MB
  • Sample260813-e4dl1sbk4y
  • SHA256 9decbb74238b66e27b5d5fed1105ca3424855270c689d6390519a4038f2767d1
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
defense_evasiondiscoverypersistenceransomware

Malware Config

Signatures

  • Drops file in Drivers directory 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Sets desktop wallpaper using registry 2 TTPs 1 IoCs
    ransomware
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies Control Panel 2 IoCs
    defense_evasion
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-13_7e2aa9c1ebefd53c339bd9a0f208a66c_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-13_7e2aa9c1ebefd53c339bd9a0f208a66c_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:3812
  • C:\Users\Admin\AppData\Local\Temp\2026-08-13_7e2aa9c1ebefd53c339bd9a0f208a66c_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
    C:\Users\Admin\AppData\Local\Temp/2026-08-13_7e2aa9c1ebefd53c339bd9a0f208a66c_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:2316

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        AppVShNotify.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
        • Size 20.9MB
        • SHA256 73288dcfca9e017f82f374f4dec54fa7fa81c61b0339326dca38604fb8777437
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        InspectorOfficeGadget.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
        • Size 31.6MB
        • SHA256 4090640261d8defad503a8a0a0ff420cacfead11f08e5d3a275c8b76f8da4477
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        IntegratedOffice.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
        • Size 32.5MB
        • SHA256 8a6f879565ff0105d433c45c51cdc318c41cf6f0bdf789d54484049a56d7d23d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MavInject32.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
        • Size 30.1MB
        • SHA256 7c02e33fb9d590c9662447b550652e170a980c6ed76a41002fc86658323e9b6a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        OfficeC2RClient.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
        • Size 31.1MB
        • SHA256 30c36aac86ae84831ec738ec78c869624ea1dd4bbcb9f420aae16623c8602ab5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appvcleaner.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
        • Size 22.7MB
        • SHA256 b7d09981f49880ab76280149a684bda5a4a9b4b2e6e848c8dafd486d27bf98ef
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VSTOInstaller.exe
        • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
        • Size 27.9MB
        • SHA256 6c0bd04a49bf83b697e027284bba5712269d131d443f460d3d1b8cdcffbb9795
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrmstp.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        • Size 26.4MB
        • SHA256 fe18c8e0ba1c9ebed6875fb6bde6f3262b2e32ec94889f83f499a97c2d3b04a5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        setup.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
        • Size 25.5MB
        • SHA256 3b9bd94d6f756b23f942362e5c79cdd2a78da1f0e38e30391ec80fd63194d9f7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_pwa_launcher.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 26.0MB
        • SHA256 9467e187e78b407c3090206a6bd595ab4df392f52ab3c0bd597b04661cc5eedb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevated_tracing_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 26.5MB
        • SHA256 babea5e8390df0f638eacd424a808cf40bc86f72380dd1dd00c98b2d36b9291f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 26.7MB
        • SHA256 02ef51cd68e567c7bac075a15947f1186ed157cea92ec003b4fcf69a89c79888
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notification_helper.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 24.9MB
        • SHA256 0edb53302707377c43cbd8986245de5c3ba0ba44319a7c3294c05edefb864adf
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        os_update_handler.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 24.2MB
        • SHA256 56b3fed28e7475a42154f2192cf893c0d5747158329aca1769bc854910d7efe7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 24.2MB
        • SHA256 404914d1eedde6f3fdedb517ef94dbe5d2cc02f988426e81adee31a81ec44ab5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_proxy.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 24.7MB
        • SHA256 d7cbdc9a7a72c4efcf82a4e3d034b4f42c1580b45ee63eea728ba0f725a362e2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 23.4MB
        • SHA256 e1db08225b343c02b8915078d39ca578be1e5fe3723ba7474f95ecfb1bef2387
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 23.4MB
        • SHA256 1931d63f842ae468c5dc38989f956e3f808efcb50c0d7c2f5b480bd55c9deefb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 23.2MB
        • SHA256 15cebd6a49fae856f9fa5305ee076607d63ea7c72346232c5e78b01438cb2642
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 22.6MB
        • SHA256 f2a105ad97a1bfd4bf9e319745d93e7d8829e097232e74085c1916cda4634005
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jar.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 23.1MB
        • SHA256 338156bbb512ef0af5b87fb2f93778275747d6f4ded8a56532bf5e367aaaae21
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jarsigner.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        • Size 22.8MB
        • SHA256 99e3d9ee1ad2b12f8228cf2f056bc45fbbe81db95a4e398245cc87614385f069
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 21.0MB
        • SHA256 17b1bdc77711402c8d54663715861552f1ee13e679a4a4cfa71a1fe76b82602b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
        • Size 21.4MB
        • SHA256 6d497d2fb8f6cf7d2e618226b99011bc25b1df65306e5680660a6586ad2db54d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javac.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
        • Size 20.8MB
        • SHA256 3ef6200a791c2e58c627a3dfd499fd58cafa35e961a193a6420905afe6835d55
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javadoc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
        • Size 21.6MB
        • SHA256 60bd1a823a4a180748cfb2b3eb4a0b1a7bcf803e9e2e92ca7f84fee5de1552fe
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javafxpackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
        • Size 20.8MB
        • SHA256 fc05d2f3e0bcddbe2e01a7067ad537f53a8f34b9c63279893f0bec8c935e2408
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javah.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
        • Size 21.1MB
        • SHA256 d28b7daf135c285628eb4e516c7bfb73375717ad8537140dd27f2d5c60938c2d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
        • Size 21.2MB
        • SHA256 71554e7f36a93f7c4a8b6b3734a88e5d996c89844f927ea5f235df26c1fb0078
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javapackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
        • Size 20.2MB
        • SHA256 4f1384edfb8bd384ea12be46f72fae5b930b46f675a866779450343c7977e5e1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaw.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
        • Size 21.7MB
        • SHA256 5912ea96e704d255055707ef8dd85cf9f86556157bcd682d7b3aa9af0a8c602f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jconsole.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
        • Size 20.2MB
        • SHA256 5e8ba51f1166bcf90003e1d4fdee15f685ef8ef99e7dd28401801c3e695706c6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdb.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
        • Size 21.8MB
        • SHA256 246a4a548ac4e1178befdd2a37b30d88f358462542e50ab0d1b05162c57a6db1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdeps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
        • Size 128KB
        • SHA256 018b597827351ef5fba9c0e1d321cfa9b45d887ff0f8d5607452eb75d8626cb5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jhat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
        • Size 20.7MB
        • SHA256 c1d4576f43d5aad712b7f425d9f40c936d3042504a66bec7ab664a5d587d6764
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jinfo.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
        • Size 19.9MB
        • SHA256 5e5e190998c5a95cd5ee0bb85998985b8d89fd9a86ae55fb13e0ed6eccbaba95
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jjs.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
        • Size 21.9MB
        • SHA256 ec31a7ca7048b401a233c3524565823e09d8ed4b4b7468e411bafb0b26c323fc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jmap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
        • Size 20.9MB
        • SHA256 69820790d07bf560469adea70acc2cc3479a5b622b683d996fd2f26c9ed58a52
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
        • Size 19.8MB
        • SHA256 022ff80fbdcd492e2a79c619e95ae9d3498d8abd0068c8da5948c82ae8d44bae
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jsadebugd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
        • Size 19.6MB
        • SHA256 db68cc7dc2382d8653c0461a4423de334f4d7a96f1ffa89e53ea11b9f9f4e883
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstack.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
        • Size 21.5MB
        • SHA256 a750cd8383d544973855b403a5ef0b6af299be5f124e07154d00ba3c981371dc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
        • Size 20.4MB
        • SHA256 e59509a417c407c02eff24b53645d41659a7dd5d02e24bc012b348f25964909d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstatd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
        • Size 20.9MB
        • SHA256 ad12094442fd5172864ac7daa7f8cb5ea13a3cc8122b4401fa8a9607c9974c5b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        keytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
        • Size 20.5MB
        • SHA256 fd95f7d1f3b8394d09514639d0af9232fa01a9eaf05eaad1bdc148efd80de2e0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        kinit.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
        • Size 21.1MB
        • SHA256 3e6033f6396ce6d449274b5245c9b35cc27cd5f0fe7dc41a98788f4403ce72fa
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        klist.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
        • Size 18.9MB
        • SHA256 2f35cd2216be5b245c3b020ce1a0d9b3ba4fcb15ebefbf97d8a27ff4c38fa293
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ktab.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
        • Size 19.7MB
        • SHA256 620c4977aaaffac618a17edafa4f0beecba2a7798417106c95437b9ac97f0cce
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        orbd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
        • Size 20.1MB
        • SHA256 df30dcf75e2b0163e5d36a3594a5edb23d83c33493d18a70b086fb50012397ff
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        policytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
        • Size 20.6MB
        • SHA256 51331c4d9e847eb7dbfcc6ca9b30d829dc58684bd7740a4a623af72686f79897
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmic.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
        • Size 19.6MB
        • SHA256 34cd56b94721f691e5820fc77477741342a002a99db306f88f426a46e48ebdbf
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        servertool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
        • Size 19.0MB
        • SHA256 8360a84cb3f42bb07774d88f7af01ef8141474fde14b36107d153811fd1f2cc4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dotnet.exe
        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 256KB
        • SHA256 a88ab2eab13680012502e10692ec5c6fb70e333b6df630e671ad53aaa93b2f63
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 29.6MB
        • SHA256 7ee9ebd80f6f4f0c9dd4b33969b5134850ee15532252b64acdf2a5dbd91ceb6d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 26.6MB
        • SHA256 05fa97bc504d0cc4b3687153b2286c50c5b3d1dba8a90d0071a1037e88094545
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 26.8MB
        • SHA256 2db0f3678f927155912fd43eaf5fa57573c1f0f99f6deeb4cd931b882c556177
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/2316-2-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download

        memory/3812-1-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download

        memory/3812-0-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download