Overview

overview

8

Static

static

3

2026-06-02...ar.exe

windows10-2004-x64

8

2026-06-02...ar.exe

windows11-21h2-x64

8

Analysis

  • max time kernel
    150s
  • max time network
    151s
  • platform
    windows11-21h2_x64
  • resource
    win11-20260513-en
  • resource tags

    arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
  • submitted
    02/06/2026, 12:19

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-06-02_6f0941a6c00c54e8150aa94f0d06e2ca_amadey_cobalt-strike_elex_emotet_glassworm_icedid_njrat_remcos_vidar.exe
  • Size 10.5MB
  • Sample260602-phc4gac12v
  • SHA256 dabf5fe69ccee1acdfb31ad20d6ffe5061e5131fe316f1448db3dc0fa6e948fb
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
discoverypersistence

Malware Config

Signatures

  • Drops file in Drivers directory 3 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-06-02_6f0941a6c00c54e8150aa94f0d06e2ca_amadey_cobalt-strike_elex_emotet_glassworm_icedid_njrat_remcos_vidar.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-06-02_6f0941a6c00c54e8150aa94f0d06e2ca_amadey_cobalt-strike_elex_emotet_glassworm_icedid_njrat_remcos_vidar.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:4544
  • C:\Users\Admin\AppData\Local\Temp\2026-06-02_6f0941a6c00c54e8150aa94f0d06e2ca_amadey_cobalt-strike_elex_emotet_glassworm_icedid_njrat_remcos_vidar.exe
    C:\Users\Admin\AppData\Local\Temp/2026-06-02_6f0941a6c00c54e8150aa94f0d06e2ca_amadey_cobalt-strike_elex_emotet_glassworm_icedid_njrat_remcos_vidar.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:2352

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        7z.exe
        • Path C:\Program Files\7-Zip\7z.exe
        • Size 9.1MB
        • SHA256 1638234b670e601838534547293199013b163527bec3096fcbafb25f6aa33745
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        7zFM.exe
        • Path C:\Program Files\7-Zip\7zFM.exe
        • Size 8.8MB
        • SHA256 f29478314c58747ea8142ced208ae4ad8b877ea95a3fd8522c8d4252a43d451d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        7zFM.exe
        • Path C:\Program Files\7-Zip\7zFM.exe
        • Size 9.1MB
        • SHA256 e60c08621abc2aae6497e2d3b8720224a9d0dee332f4506be1cf2b4143e0a7f7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        7zG.exe
        • Path C:\Program Files\7-Zip\7zG.exe
        • Size 9.0MB
        • SHA256 cc07e2f71cef771ba13f7660ebc3a1e4c7cae4f06f169e3ac30d11fb1c445638
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        AppVShNotify.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
        • Size 9.7MB
        • SHA256 6b4cf11188282827ed1576cf349aa0c8527072a8cce4041898fb351380f6ae5b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        InspectorOfficeGadget.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
        • Size 9.1MB
        • SHA256 ca23aa93b7ea2a73d27cf21e0e82a56b489e5d68c16f76cc97238de97ec94269
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MavInject32.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
        • Size 9.3MB
        • SHA256 698f9486f289ce038d652a85eb5dc9e0f4cfa8cff81af78aeae49a0f23c06e7d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        OfficeC2RClient.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
        • Size 8.3MB
        • SHA256 7e7b9dce8a8e627aa8a6a77b490ce3e6d180261b8fa25cbffff55024f31a56f0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VSTOInstaller.exe
        • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
        • Size 8.5MB
        • SHA256 7930c43550b4563f25cdaba0070555906e06a77188a0a2f2595d3534521246fb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrmstp.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        • Size 9.0MB
        • SHA256 4542cc0c7ea102defbcffc7b3356deb3cfd5f6e1825334a079c382d100de22ad
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        setup.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
        • Size 8.6MB
        • SHA256 c7749bb792d94b84a26d2f418de90e7728ba09d22bc544d5f8a176fb03a2e2c9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_pwa_launcher.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 9.2MB
        • SHA256 7967fe3aea50c26bf8b262b157afe2b36204f4af0de619810d5e8db8d6acf7f0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevated_tracing_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 9.3MB
        • SHA256 fdd71cdc1a057807f6cf7bf5f3554250469805d78d58016f93b388743c25cd42
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 9.2MB
        • SHA256 36ef22e92bc5f1db1945536bd1aa96292ed4dc97ffe0be880dee46d125f1ebd1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notification_helper.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 7.6MB
        • SHA256 e00e57018578d145430fc423582e2992a488c7c560e8f78998935fb4c97f7e23
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        os_update_handler.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 8.3MB
        • SHA256 750110b6aad6993a8f0e147a9ab072135929a2d6744b3364312f931b3e3fbb4d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 8.7MB
        • SHA256 ad080140cbfdd9a919a1f9ddc008ec2f7b3d4376f50e407cd8f8ad732757f347
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 7.9MB
        • SHA256 59918dfa44a71cb1be7e1464cf0b89c00c97bcafcb0aef5f10092f341f8e9541
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 7.9MB
        • SHA256 ef0b548da82a965a9175cef82255132b860398e2b1a84bc1e243a7ddf281a8a1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 8.1MB
        • SHA256 b060a982731710809500add00660067b2c0bc8b714fab7fb80e5c05c6aa3c4d0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jar.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 7.6MB
        • SHA256 2ba49cfc5173ef22a3b68b00ccacd54467fbfe874b712efb33c2f2dead30bd56
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 8.0MB
        • SHA256 891af7fd89e10ff28aef3d4b30b4619df6fd953201895edf61f38e1a1d11a266
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
        • Size 7.4MB
        • SHA256 af1eb12879bdc0de9ae76f6c4f68f370b543faa827cbe0a3d94738c75b464af3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javac.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
        • Size 8.3MB
        • SHA256 0e0e72748f02816a05ba44013ab333e25f2ab4e1fbc9f69fb9d954cf03db0b0c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javadoc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
        • Size 8.1MB
        • SHA256 a714f9be02c24c06b2413cf99af102dcb4843bc66a8cdf4613129186668eb7cb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javafxpackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
        • Size 8.3MB
        • SHA256 95c5f9a75acf4ec819d62120670675918f0794bcee87f7cc4abdaa03d2bf2309
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javah.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
        • Size 7.8MB
        • SHA256 6b45b021cc8a9a95af552271e15f91be5243a18cc78480fd3db4b01604d7023a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
        • Size 8.3MB
        • SHA256 292928506c85f46fa57eb797c50bd248b4155de28f0fea0b196bd333e2753115
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javapackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
        • Size 7.5MB
        • SHA256 726a3f0f40e9074a815341f468d462fc8f7b33187b8144d2dc9b01668152f62b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaw.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
        • Size 7.9MB
        • SHA256 0e160151fc7fffe95b42e7371c147bfd814843c7cd5e6f83cec4909a04bf3305
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
        • Size 8.2MB
        • SHA256 de09226ab40a40675b0714cfe83023a8a3a0c819378ca3efb09316acb76bbec5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jcmd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
        • Size 8.0MB
        • SHA256 7bd90debcfb10a55d40b364552305f152e97cd77781923ab600ecf301630b836
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jconsole.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
        • Size 7.9MB
        • SHA256 b70e1479ed7cb829a5b2a0773bd3669f543881bfdfc681cc1d7fb8a339300f53
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdb.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
        • Size 7.3MB
        • SHA256 e8eadbd60c46ba6440e45599c5ba15ff0766c675eba220f7584f046c032271c9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jhat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
        • Size 7.9MB
        • SHA256 17bfca616874b0c8041dd10cb115d154a3ec3707246b5a402d69356be032a34c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jinfo.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
        • Size 7.7MB
        • SHA256 ce666aa8e5674cf52333947bec3ff11c9428821edebc9d36d3e2d48085b3732e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jjs.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
        • Size 7.6MB
        • SHA256 636764755be4112296ee42141c2b5fcc87abbb380a996380a946b873139f700a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jmap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
        • Size 6.8MB
        • SHA256 21b593e898162f859ff343b360038712c530ddcc69e2ba72e839e287a2dd84e8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jrunscript.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
        • Size 7.6MB
        • SHA256 86279628f875f437035a2284090328b277b8be653d408849c437cef3609d1eca
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jsadebugd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
        • Size 7.8MB
        • SHA256 7dafe933c696a92cfbd348d5f832e8709f76a9e391674f17c265f1d850e81757
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstack.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
        • Size 8.4MB
        • SHA256 9728cec0953ac82ddd24898c09d845a691d2a7d7b97ed5b8a66589d334be386a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstatd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
        • Size 7.8MB
        • SHA256 7670ee59c26d57346fa594241a09ea7e9166931e2cea41fbfac054fe87ecb3ec
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        keytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
        • Size 7.8MB
        • SHA256 61b0e831aa525cf8b2a0d9ab2b24e046b8693cf5eb81e2e8ae442c395b48d6e7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        kinit.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
        • Size 8.3MB
        • SHA256 70f9a0a5dcda042f0b3cd1d4289f9abdb8bfa1bd28254003b878573b3f60db28
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        orbd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
        • Size 7.8MB
        • SHA256 7c119805e20c733c7f5a43a73ac4cd8dfd75d892befcf858ebcc0df27d95469a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
        • Size 8.1MB
        • SHA256 afa3813304eccff8316d7be507decd89e20daa8d5ac0edc1513afe9a90f94299
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        policytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
        • Size 7.6MB
        • SHA256 b52025cfb808b0beedfdbb54cee8c0b975600c096d74a9f23f65d52025ee225e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmiregistry.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
        • Size 8.6MB
        • SHA256 8f70df15b6399d79a7024d76363c522a3d029e2cc0f151acb77e701a1910fa96
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dotnet.exe
        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 8.5MB
        • SHA256 f4f90b871a4b730dcba255ed8d2a96be9be173d22d7fb45e6acf2d822080c89d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 8.6MB
        • SHA256 f4c12eafa7c1a5dc50e7f9e06e39fdd9a29a74e0abcbdbd899713472a280531d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 8.9MB
        • SHA256 4b4e61e91e4e86cfc57b2bc6a84a9fb3c1ccaae00fc10c1cbbf851f349788b83
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 8.9MB
        • SHA256 1505499d91a5dabb81595198052f398fdb5864156cae56a7c09b0ef711e3188f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        spo0lve.exe
        • Path C:\windows\SysWOW64\drivers\spo0lve.exe
        • Size 9.1MB
        • SHA256 aea0da2bf110abe18901828fe8eee0470356393638aa3469c1e94272a6281986
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download