Overview

overview

8

Static

static

3

2026-08-15...ar.exe

windows10-2004-x64

8

2026-08-15...ar.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    150s
  • max time network
    123s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    15/08/2026, 09:50

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-15_0d1aaa8a9cd52f4d254e3472ba6dfad6_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
  • Size 11.0MB
  • Sample260815-lt6ndafa87
  • SHA256 6f4d6021d1593b4d3cf7c555566b12b48b34525f7832e4523d6843cbb67348ee
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
defense_evasiondiscoverypersistenceransomware

Malware Config

Signatures

  • Drops file in Drivers directory 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Sets desktop wallpaper using registry 2 TTPs 2 IoCs
    ransomware
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies Control Panel 4 IoCs
    defense_evasion
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-15_0d1aaa8a9cd52f4d254e3472ba6dfad6_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-15_0d1aaa8a9cd52f4d254e3472ba6dfad6_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:1728
  • C:\Users\Admin\AppData\Local\Temp\2026-08-15_0d1aaa8a9cd52f4d254e3472ba6dfad6_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
    C:\Users\Admin\AppData\Local\Temp/2026-08-15_0d1aaa8a9cd52f4d254e3472ba6dfad6_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:4972

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        7z.exe
        • Path C:\Program Files\7-Zip\7z.exe
        • Size 11.6MB
        • SHA256 dc0dd5475407b428bf91a14eda61aabd068db3f36ae5a0ee7612dfa48d9b6e6f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        7zFM.exe
        • Path C:\Program Files\7-Zip\7zFM.exe
        • Size 12.0MB
        • SHA256 6562bca58eeeb7bee79920a9dd4c2386eac5f2e5428b56048ff3f2cc511befef
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        7zG.exe
        • Path C:\Program Files\7-Zip\7zG.exe
        • Size 11.7MB
        • SHA256 b6cc81d94cabfda528b8882f826d32e01b0954b831e54da5ca459f551254272d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        AppVShNotify.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
        • Size 22.4MB
        • SHA256 046d3d8e29aa0b00bcaf386979566cf87b5d8d69acdec83077c44ce7fe9594a9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        InspectorOfficeGadget.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
        • Size 22.1MB
        • SHA256 42ba8d15fead3ea7d076da06a758f79f919b63c2d123f0ec94e4370495f942d6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MavInject32.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
        • Size 22.4MB
        • SHA256 c49d1a3004236a1df7ecc5fa41e4e6fa97510b755ffc2490d8babda9d4e889b9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        OfficeC2RClient.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
        • Size 45.6MB
        • SHA256 81e131c68e2e3481b78ee36f165fc12b731ea08da682ee4c12a477f4c0761405
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appvcleaner.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
        • Size 24.2MB
        • SHA256 5a1a9f1444c0b2ff72b3625fe86e1be2fcc282e08df53dd247282c539e7e5bcf
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VSTOInstaller.exe
        • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
        • Size 22.2MB
        • SHA256 1024e62f409f45f1fc7c18e9b47655ef8bfc159aa4a7a3457c4efb18b32e9a58
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrmstp.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        • Size 28.1MB
        • SHA256 3d251de1e1d0dfbaec9feefea02db1d58d7feb798e28c134cf5ceff5bc1a5bf0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_pwa_launcher.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 23.8MB
        • SHA256 1d42dc72e4d4f9b344151c0b736ea77fabfc53feff930ee48ea9942588d7bf96
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevated_tracing_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 25.5MB
        • SHA256 46528b2772adc5fe41b0cadc1ef9e5ca034f216b6e7791db94125361aac4737b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 24.3MB
        • SHA256 3c6cbdcd4e8b3a123db8cd6ee72faa31c29b9ef16100e804c9cf7ed5a92afd72
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notification_helper.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 23.7MB
        • SHA256 718e58d6b2145d068e7d63c4955f346d6a7a0f46205aa3ad175ecc919094913c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        os_update_handler.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 23.9MB
        • SHA256 819dff24b216cb45985d87c4917ba4b3373a4fa555648d1374e250447fa1e458
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 25.1MB
        • SHA256 cb32d2df6cb6e47bf91c1488cdaee0e4e5f195194f2804205e5c0042554c0beb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_proxy.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 23.5MB
        • SHA256 bfc3557c128b0991401cdcc172281efce7d245829abcb08c1e20c5ae8bd50159
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 22.1MB
        • SHA256 50f9c8b2d93b217b1dec58965920cd5c04b5223e9ce7ec7b1a4f3e945b23ff57
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 22.1MB
        • SHA256 04883999850b2e86b09800b1252037f61ccf2fc2ce65e835211931418b2fcc96
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 22.1MB
        • SHA256 2b89af5947d5e1455441af6e20e99b7037638da967e5019184c5eabea82ce87f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 22.1MB
        • SHA256 f29fb0cf29f9a7e40a50cb13263683969bb5546becffa9ea6fdc35df85a23642
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jar.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 22.1MB
        • SHA256 52a57407278a697dc71fd549935c826a735566bb0ce226fa430d9ae1b5b07df2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jarsigner.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        • Size 22.1MB
        • SHA256 89c652e7b0d7a1316462cc335f8270a64b4d49a2a37e52d11e6f8e657c07778a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 22.1MB
        • SHA256 bbead9f48874ee50852efe8432ba788fda3856cbe7f90febe38c26d32dd701cd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
        • Size 22.4MB
        • SHA256 0a798361569c3cc0032571226a1997b52dac8ef75ded82539607a54524dc3f1f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javac.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
        • Size 22.1MB
        • SHA256 2f1871ecf112848234d33603da82e5ab7415b5e32bbe6dad31d84d8f38625a7c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javadoc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
        • Size 22.1MB
        • SHA256 359db39558dce4602a64b387bf1cfc38d78bb03acb0fe38308ec962fba8ddf09
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javafxpackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
        • Size 22.2MB
        • SHA256 36ae135f70b0918ac9f66d80c675cb1820b41630d91b0edcbda0187ed372a9a9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javah.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
        • Size 22.1MB
        • SHA256 38453a16ed722d192cee6b6e742de81b90943eab97b6de1168354325779b1534
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
        • Size 22.1MB
        • SHA256 c16db4d6c99e1b3b322cd94da7128968750a8880b37a6add0d80ad6e19d513dc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javapackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
        • Size 22.2MB
        • SHA256 56925133474c2b5a09f0a7350e784a1fdae6c6d9ae0a8bdd6786915f8282b759
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaw.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
        • Size 22.4MB
        • SHA256 ebeead591b3aef9003313affbdeb23fa468eb38935b1e6cae4054dea6d7653a3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
        • Size 22.5MB
        • SHA256 1f6ab14506565a9fb90252e469254afee135c628be1d4534e141ff09b4901b44
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jcmd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
        • Size 22.1MB
        • SHA256 4f7397b52171f822c951a5754d5d4305a3829928de9214ac3ab6070c21dc19bc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jconsole.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
        • Size 22.1MB
        • SHA256 880872b1acef64c6c4a3c18fae00267e1879c94bec340a5f6dfc3419f0d99894
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdb.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
        • Size 22.1MB
        • SHA256 190b90c80204510bfa3e85daa41d0a3ade694ee2d96ccf02d49307fc0062bb4d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdeps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
        • Size 22.1MB
        • SHA256 e4daed8d7414c57bd880fe8c1f20d1d5d46a7843c254256ee494748b0ec556f2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jhat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
        • Size 22.1MB
        • SHA256 cc7e773b4642aa856a5b8463bbc1f864597140c4208f794bd0e826ad2ed3900b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jinfo.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
        • Size 22.1MB
        • SHA256 b867ee686b01529d2485834b6bd5c4982545cb10c5c8f5c73aafad10a32dd7e5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jjs.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
        • Size 22.1MB
        • SHA256 9eed2b9cda0195b4c36bb4d2a8dc6c171d00f0d1a437a963a1252103c1f54214
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jmap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
        • Size 22.1MB
        • SHA256 2835ef6c14b9b63c06239df983e8c77700071ba82fbb6e38c284e17cfb94f8ac
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
        • Size 22.1MB
        • SHA256 079d32c75bf018151bf3d7e89d8a03b9e04646278b3ffd5c69c1130d36ed11af
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jrunscript.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
        • Size 22.1MB
        • SHA256 7b2cb5556cf1641081d7530c7c58ea07e73294bb490deab245ffcf5e7538e39f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jsadebugd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
        • Size 22.1MB
        • SHA256 858312c79fd167b2cdf982ebe51ae1e9001b1e6250ca5862b245f3d440e79c72
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstack.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
        • Size 22.1MB
        • SHA256 6efe5684a24ff7d27138b9a1ea2fe3e7ae2bd9ae1787c2bec37dc39e1d7dd413
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
        • Size 22.1MB
        • SHA256 7fd86bc9d56fad72ce2f8c06c9002a97cfbce44d2ddfbcd921606b8042fd5e18
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstatd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
        • Size 22.1MB
        • SHA256 64057cf25c7d142e169eadba60d52680ca6186db3ed45a59878c82528f7374aa
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        keytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
        • Size 22.1MB
        • SHA256 cd8024db5ae58c1a260ed660c0bfa4e2e6fb5d222843aaf8bf4ebc931374c107
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        kinit.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
        • Size 22.1MB
        • SHA256 975d221c557e2e5d99f2f63dabadd3fb57ee62f3d5f917909fff4db7b7c4a38b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        klist.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
        • Size 22.1MB
        • SHA256 adc1ecec2b09f185dbc7e7dace18f335701d875f45fe29c12fb8fcb12b735933
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ktab.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
        • Size 22.1MB
        • SHA256 f9bb197c42fc3cb2677ea41e8cc50a685adf110e9eb6db2f68ebf29e267682b3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        native2ascii.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
        • Size 22.1MB
        • SHA256 c6a26d2b160e7cf460a6c511af05fd1937cf7fd7c87ebde1655abc7d1ce42bba
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        orbd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
        • Size 22.1MB
        • SHA256 d6c3ea14dbd716158b9012c4858ca6d8dfcac7e92c5fa5ea37f71fd6a4401be1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
        • Size 22.1MB
        • SHA256 866368c8afea94348368a8930c04354cec3394328a8fe4ca972d25d1c864144a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        policytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
        • Size 22.1MB
        • SHA256 a8e38898b0ee2ef8c4573569dfea4f9541b890dd824aa4f3ea791e9f8d8024e8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmic.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
        • Size 22.1MB
        • SHA256 92ce64020124b3b5fe565a94ad7fd05630f2d686a131fd0efb56d617b2da5e95
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmid.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
        • Size 22.1MB
        • SHA256 8241cf53798c5da9c17841ae9efda028b7df3d746cff0f6d6205d72a070808d5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dotnet.exe
        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 22.2MB
        • SHA256 36590ef400349abcdcbc6dcf4dc65357ba3c16d6358a5e80ebfa06370c795363
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 22.1MB
        • SHA256 7d9cdcbb9f1e72468609a4403e88de7b209752d01436c0f5cfb6da45b7c293a8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 22.1MB
        • SHA256 ae47c803a8eb96709d35fbc445dd2a1bd09c61ceec58f4bc03f5aec486fd2dd8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 22.1MB
        • SHA256 b06c02bb9285b4a9a9eac604252a9b04b64649ea3759ff9064da17c5c9723df9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/1728-0-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download

        memory/1728-1-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download

        memory/4972-18-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download