Overview

overview

8

Static

static

3

2026-08-14...ar.exe

windows10-2004-x64

8

2026-08-14...ar.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    150s
  • max time network
    151s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    15/08/2026, 00:05

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-14_32a330bf2a14543d163ffe5157228819_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
  • Size 15.0MB
  • Sample260815-adedeavbkh
  • SHA256 a1969929b9dcc3832dc6bad62e8f0a1f073aacc8aeb21d7952bf6056235ed429
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
defense_evasiondiscoverypersistenceransomware

Malware Config

Signatures

  • Drops file in Drivers directory 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Sets desktop wallpaper using registry 2 TTPs 2 IoCs
    ransomware
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies Control Panel 4 IoCs
    defense_evasion
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-14_32a330bf2a14543d163ffe5157228819_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-14_32a330bf2a14543d163ffe5157228819_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:3476
  • C:\Users\Admin\AppData\Local\Temp\2026-08-14_32a330bf2a14543d163ffe5157228819_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
    C:\Users\Admin\AppData\Local\Temp/2026-08-14_32a330bf2a14543d163ffe5157228819_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:572

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        7zG.exe
        • Path C:\Program Files\7-Zip\7zG.exe
        • Size 15.6MB
        • SHA256 56ce2e6adab4d3883f72b07d0aaa3ad3549a2d5a55584e7331e1869bf9f3203d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Uninstall.exe
        • Path C:\Program Files\7-Zip\Uninstall.exe
        • Size 29.9MB
        • SHA256 bc7f6f6e5293997c21a4d46d60fd3dfefcd2540b8bd9c909c82352a9c4acb1c1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        AppVShNotify.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
        • Size 30.2MB
        • SHA256 15c3f931174566609fb8f1e1e3f8c060ba8acb6e0551a06569cac655ab1de833
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        InspectorOfficeGadget.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
        • Size 30.0MB
        • SHA256 af55e17a17c0213396d3875399b618227573790c1a37634a3909a54d62f362c9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        IntegratedOffice.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
        • Size 34.0MB
        • SHA256 77587a85925b7db72788d46bcdd04db0c79c938bad34157686a8767b2b8b78c0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MavInject32.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
        • Size 30.3MB
        • SHA256 c352ad7e276f880140e5955623a7e4c467f98c7cf3421c7b50376e41445b141d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        OfficeC2RClient.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
        • Size 53.4MB
        • SHA256 229ce626499008fb1bbd55703534879f53d36fbe2380d387cf19a3d21789bce4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appvcleaner.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
        • Size 32.1MB
        • SHA256 f89ece46fa95996ea93c7080ccdd73a6db9cc473f1b017c6cf331d4140d27b91
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VSTOInstaller.exe
        • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
        • Size 30.0MB
        • SHA256 8f3293fd825b60e435964d2d12b43cfd4d77cd0d98661fd5b4f3bfdb854b3f0d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrmstp.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        • Size 36.0MB
        • SHA256 55112dc0fee99dccc4436d47004e49ef6b5a8ff1c9d4d83a866f0597ede46a79
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevated_tracing_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 33.4MB
        • SHA256 69e3c100347088d10a1651abadc0a7b3d7318219c40e23ca11ff9a5eeb8285cd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 32.2MB
        • SHA256 8e3c9c9c725ac14a4f6cde295d7ed5ae72db791e1dd25a4ded8b1020d95a39f5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notification_helper.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 31.6MB
        • SHA256 5b9076a51ef1f14523b6245dd83aa64cb60888a12bdfdcbfbd30fc53eb1c52db
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        os_update_handler.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 31.8MB
        • SHA256 7c372291e15afe1273433b522a924c802bed130379a94355cdc60e25360dece0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 33.0MB
        • SHA256 cc50445725b0adff995c16ec9fae6b1e61430e4d1edacb3fc6f41425185e0b14
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_proxy.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 31.4MB
        • SHA256 f32ee35c1cecc779e5a4448028d527f5de60d1c85822bac36f7cce06df03a400
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 30.0MB
        • SHA256 90e4946fe0bb8f10dfedcbf94bf0cfd97fb80687417bbc4891f94d4cc262f70a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 30.0MB
        • SHA256 61104e6ff910532836c433127029886889ceabb342da0d4a6b50d2a02416b80c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 30.0MB
        • SHA256 1ca2cb289b3b5428bbd1d38cbc85ddedd91d2125e1b5c7dfe86be25b2ea0af3e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 30.0MB
        • SHA256 ec5651721deb4445d95359d857cefafffaf29439aa9be3b58f108a127cc89bd2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jar.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 30.0MB
        • SHA256 d8cd14f0ee53883b64111115f936ee5c4bc98688496fc64779e54a48ea7c1c40
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jarsigner.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        • Size 30.0MB
        • SHA256 0b4fd411a39a42ef1efd2e5983e2bcdeb8359be6519df75a3d896a1c03685522
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 30.0MB
        • SHA256 cac60a81d3fbe69ca76a4c728bc02fdff6a9fa8a935f1e23934bc72328087bce
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
        • Size 30.2MB
        • SHA256 63bd746dd9642c06e780b9fd17a87a658e3bc2fb9b375719c9a2e45930657c47
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javac.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
        • Size 30.0MB
        • SHA256 1314c2c9d98b1ba41bce4493466fe75dbf9ffab18e6549f5207a449e1b5dda2e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javadoc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
        • Size 30.0MB
        • SHA256 97a34a764b9868f8e917db655ad355e34577819cc4ce7f622eb2ef5034de0555
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javafxpackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
        • Size 30.1MB
        • SHA256 4651e4d7442e186e5e3aede6bf83484a7dd41859bfc97cdd1bcc7914fe1c28ac
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javah.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
        • Size 30.0MB
        • SHA256 8923289257922673d2340927f88c277c687c2b27e6eb8eab55a7f5305b97390e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
        • Size 30.0MB
        • SHA256 78f28d28d27c2cc3139cee617e0e18e6701864533c269302c07609b64954a556
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javapackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
        • Size 30.1MB
        • SHA256 df1c44f997fdb7b43c9b7bac3a2b05ac3f3961756a0d93c33b919e5fe50d2b17
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaw.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
        • Size 30.2MB
        • SHA256 91cc80d309086d9984aa29c22b6ce87d13f505ac17b16671a84753136c628cbd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
        • Size 30.4MB
        • SHA256 56cd7c70b22f4832bc51c37083dbfb952d99f119195c46c1348d2c44babf2ee1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jcmd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
        • Size 30.0MB
        • SHA256 544ec3539d807c44b58252a8f7dadd75f8a7a51100d710f8a1b52e58bff8a3c7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jconsole.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
        • Size 30.0MB
        • SHA256 613687cb2c69e1ff39b201526d8f5402b0606a29fe019b254f89257ce3fccd82
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdb.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
        • Size 30.0MB
        • SHA256 b0d320ac9a057793936f8488334b18ed5dba970c9ee4b274ecc04cce13d2dc5d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdeps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
        • Size 30.0MB
        • SHA256 6128ed7a6bf15b7691b9b16c0fe831ff83ee45f3d9e86d5a07ca4c01877a959f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jhat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
        • Size 30.0MB
        • SHA256 a1d1fa427d59ae1b4f3cc60a0fd345c8f04ef21f8a7538ac27c708d038289362
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jinfo.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
        • Size 30.0MB
        • SHA256 362eb4fc16663e242938d41d818f89ce0c46ed858e15d1feb75679b45eb771a9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jjs.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
        • Size 30.0MB
        • SHA256 90a86ff529ba8547d285c5d07e3fa1afc78e1cd5aa65e02c8f38532be91fdf20
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jmap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
        • Size 30.0MB
        • SHA256 4cfcbfd039c586cae18241133b30061762df01a51582880a04130ba40127e74b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
        • Size 30.0MB
        • SHA256 a6bbae9d0aeab9ee86dbf12a3bd82553c5bf18fdea4add8ed554af91924219b9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jrunscript.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
        • Size 30.0MB
        • SHA256 bbd44ade3cb76847aa3dff7e6f27676cd559fe7c7a91302109321481620ec054
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jsadebugd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
        • Size 30.0MB
        • SHA256 869dc8584a2628a3d3b47d0b4fd44a3b6c144a343dcc5523d6cb0f33d0e36356
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstack.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
        • Size 30.0MB
        • SHA256 cd4d83b49ff8078ddc20d1f789190fce46ae3165ba512136b9acb884f6880eef
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
        • Size 30.0MB
        • SHA256 f9a73e48545f0b8a2ddefbbd39c34922945be965d18eebcec9ac9348c8a0225c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstatd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
        • Size 30.0MB
        • SHA256 4d05825d84676d7e1b92706ca1c2b1a0941ee95c3a04cf36721995651ed5ad5a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        keytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
        • Size 30.0MB
        • SHA256 a0da70c3d73553e9ce762f8b15add7ee220c5e4ebbec76ccefb84c3a7323f7a7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        kinit.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
        • Size 30.0MB
        • SHA256 426cfd8d498b9919a3fb07b77df923d4da6fe4130f6ebbd69504363b7bbfeb52
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        klist.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
        • Size 30.0MB
        • SHA256 a657b431dfae2da1ec979cb91e25020f2357e431233231c466fad883ede894de
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ktab.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
        • Size 30.0MB
        • SHA256 fe8bfc4ddaa55a0cc45b1ed0be73db97eec7501b3e8898146e7e59556135fdf7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        native2ascii.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
        • Size 30.0MB
        • SHA256 80535a019b1f364fac1a18aeb88c372e2ef4dc130cc56a26bc684b97bd8576a5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        orbd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
        • Size 30.0MB
        • SHA256 c85310be20a0ec6681498cf0a56e0f01649145c546995c5f64b71b8c1347d8b2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
        • Size 30.0MB
        • SHA256 0ed5abeec686474c42997c6656100bd67ff8dcf7ce1aa9e65ffe042bfe6b2e06
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        policytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
        • Size 30.0MB
        • SHA256 15c7ba2aa80aa8f71edd3826e53f7009e559cdeb92342e224e7d71b0ee1d6309
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmic.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
        • Size 30.0MB
        • SHA256 088ba6650e0eac0dd3b647daf6a3f82545fb138b988c871969d664302ee5d38e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmid.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
        • Size 30.0MB
        • SHA256 c24ab333aca80a6177a6a224d83b094792f64dfc57d22cfdae66e582e0886f57
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmiregistry.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
        • Size 30.0MB
        • SHA256 efd900227d4189b8e507a3f904014ac3d31a6de4686d791025eaa0990c99196d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        schemagen.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
        • Size 30.0MB
        • SHA256 9c04d1f50966dc99a190962e9ff63717691a93d3fdb440cd23abd12b2bba79b4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 30.0MB
        • SHA256 a0791992943bdc0e8f7d1b98de57096796d801cfd6e043645c71e3d1a21d1e67
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 30.0MB
        • SHA256 5ad5ea30e6066960e9278dabbe53c6e6a517d22ca4821ca5ed9a8e3affe33cb2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download