Overview

overview

8

Static

static

3

2026-08-13...ar.exe

windows10-2004-x64

8

2026-08-13...ar.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    122s
  • max time network
    115s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    13/08/2026, 03:58

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-13_a6f2e9576ac22a1c899892fef599079d_cobalt-strike_elex_emotet_icedid_remcos_vidar.exe
  • Size 36.7MB
  • Sample260813-ejp5baaq4x
  • SHA256 7bb589d66c8a9f9c32505e0836c050a5f18ee3040b6526610ee787e73ec8dc9c
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
defense_evasiondiscoverypersistenceransomware

Malware Config

Signatures

  • Drops file in Drivers directory 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Sets desktop wallpaper using registry 2 TTPs 1 IoCs
    ransomware
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies Control Panel 2 IoCs
    defense_evasion
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-13_a6f2e9576ac22a1c899892fef599079d_cobalt-strike_elex_emotet_icedid_remcos_vidar.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-13_a6f2e9576ac22a1c899892fef599079d_cobalt-strike_elex_emotet_icedid_remcos_vidar.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:1716
  • C:\Users\Admin\AppData\Local\Temp\2026-08-13_a6f2e9576ac22a1c899892fef599079d_cobalt-strike_elex_emotet_icedid_remcos_vidar.exe
    C:\Users\Admin\AppData\Local\Temp/2026-08-13_a6f2e9576ac22a1c899892fef599079d_cobalt-strike_elex_emotet_icedid_remcos_vidar.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:4968

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        AppVShNotify.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
        • Size 37.0MB
        • SHA256 beb19e546cfcbda02273ba62fee6b6a39e5537c53d88ac3dfbb0b09e37592c8d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        InspectorOfficeGadget.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
        • Size 36.7MB
        • SHA256 7bb589d66c8a9f9c32505e0836c050a5f18ee3040b6526610ee787e73ec8dc9c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        IntegratedOffice.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
        • Size 77.5MB
        • SHA256 e08e5067d72af9489533a10d2f150f2c1efdedf3e0afa05d0ba43261f7392999
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MavInject32.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
        • Size 73.7MB
        • SHA256 23e3bb90b376963c5046a88737f1f0f2399e14d48ac0c1b30e49c69d85b53c27
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appvcleaner.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
        • Size 38.8MB
        • SHA256 3bc3860cb703b770ab47541bc1b72aedc4b8ae15a8306d0bc64debb11809f939
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VSTOInstaller.exe
        • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
        • Size 73.5MB
        • SHA256 841ed6582426ad3e384b097a373862734c5f786d2ed2964e26bb364a99fecfa8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrmstp.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        • Size 78.5MB
        • SHA256 581644673ec19e13ee770588391ac38e06201f60abc77896fdc421858c5dd1fe
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        setup.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
        • Size 78.0MB
        • SHA256 9adbc0caa73ead98a9d7a3d7671ce7ee4a1bc4dc473fa7e0f50b162dbb01b3dc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_pwa_launcher.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 75.1MB
        • SHA256 261af226010fdff7b27eb20e8cb19b0419ee3940d64e86bf3b0c40a37c1aa518
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevated_tracing_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 76.8MB
        • SHA256 454abe36d911a0256deffca758b4b80b72ace7c5eb2f7e328dc7c7d145504b41
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 75.6MB
        • SHA256 c8a56c9e40c7444fee6308c290b6e917dcd2461ca57cddbbf00aa5c2fe5aec36
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notification_helper.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 75.0MB
        • SHA256 8c873f9b7326769083e129e7d7a2a5b8c3e8457f8096eb70dec47c63bc19f980
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        os_update_handler.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 75.2MB
        • SHA256 48443b17bd141b18665e5e629cfd91e3399e586a5d4f9842e26ec8ed03311444
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 72.8MB
        • SHA256 8bdde3168ec28519b93fcf7e0ed2ea691f7ba281ad14f9566e2e117c936587fd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_proxy.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 73.8MB
        • SHA256 ba5e0bddd3f22b61432b694964f2da91794ce6446a89cd734c30e8ce46e58415
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 73.4MB
        • SHA256 0c631c6031d17d9b50954204bad2cfa87ef0096733f50d9a568495ba1e99f0bd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 70.4MB
        • SHA256 bc2391ea69990947f3db57899fece25328cb27aec1a2f0bb1dea14d818374287
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 66.6MB
        • SHA256 ace94e8dfdce8918dc1f41813c5e194dcd9d458c77e3250e2e73a40b166add45
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 66.4MB
        • SHA256 fff08c24ca88c359f08a59d9c28d1b9c52b05f5b8b8501c8d2a7f3c0fe16865f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jconsole.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
        • Size 63.8MB
        • SHA256 57eb5917eadac4b26f6ddc5f25c9352621a4da7d50da57e1c2013a9f33f69e78
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdb.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
        • Size 62.2MB
        • SHA256 2c9ead2de0ae372796142e7b2b0f1af710202d52848402d5700954110a5a2a91
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ktab.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
        • Size 57.6MB
        • SHA256 b3115e42d9927721ed3af06377284c143a1c5c8ad2ec3f513b11f82957ecad08
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        native2ascii.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
        • Size 55.4MB
        • SHA256 3a318df17db81dcd0074f70c1f3f7d4c9e570e141a80ce627488cb57563dd675
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
        • Size 54.8MB
        • SHA256 b2ad465a729e18e0f350aa1f11da8cea5cd03dc1967b4db6f89f1fe960b80a42
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        policytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
        • Size 53.3MB
        • SHA256 54f9f2073388e44a1fe203343bac22661125d755b2b3a2038058b2dffb0db0f3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmic.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
        • Size 51.3MB
        • SHA256 f234b5f23414599da6d0079384c6ecdd9799c8078f2538d79dc38cb667f4d35e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmid.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
        • Size 50.0MB
        • SHA256 038e2ec8c1c56df2f3339e3df475898a6222e506425d77179464972932344ad9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmiregistry.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
        • Size 47.1MB
        • SHA256 9d57401bae4863292858668787ef95c7c5880d7cbbeff8918ca49093d4bddc2c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        schemagen.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
        • Size 48.8MB
        • SHA256 9fb49d08d176e74552220216c102313c1b745b3144dd385dfa6e1d14047dfa81
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        serialver.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
        • Size 47.9MB
        • SHA256 b6b6ea6891067f249327ab8b604878c35d1a918425c8808d9f09369dfcf2814c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        tnameserv.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
        • Size 46.4MB
        • SHA256 30f65e30a8252bfa26d5d12d5e2e6d665239846b27f3dd82606792477fc5df7b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dotnet.exe
        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 73.5MB
        • SHA256 d7e09379c4351a67a89fe31d6d43d6d82f5d9ff859fa7a52e991e6d5709b8842
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 73.4MB
        • SHA256 4521a36def187580a56c9dee22b31fd27415499ecb536e180b72b0fd6a941cbf
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 73.4MB
        • SHA256 8975867612dd7878f2f4a3b0af5da9e765e1a645290245ac0fde3e2317a74add
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 73.4MB
        • SHA256 fe864fbac8883c6f3a7ce0dd8b27b62b3e179e894d7c67ff19393e16111bde76
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download