Overview

overview

8

Static

static

3

2026-06-27...ar.exe

windows10-2004-x64

8

2026-06-27...ar.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    148s
  • max time network
    147s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260617-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260617-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    29/06/2026, 01:23

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-06-27_f30b6e69c465e6a4703a7bc4b751cef5_amadey_elex_emotet_icedid_njrat_remcos_vidar.exe
  • Size 14.4MB
  • Sample260629-br9bdabt7p
  • SHA256 6a042804fdb1b2170634ac7345b3f82a5027702fbdc85e96d8ae736a599586ff
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
defense_evasiondiscoverypersistenceransomware

Malware Config

Signatures

  • Drops file in Drivers directory 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Sets desktop wallpaper using registry 2 TTPs 2 IoCs
    ransomware
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies Control Panel 4 IoCs
    defense_evasion
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-06-27_f30b6e69c465e6a4703a7bc4b751cef5_amadey_elex_emotet_icedid_njrat_remcos_vidar.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-06-27_f30b6e69c465e6a4703a7bc4b751cef5_amadey_elex_emotet_icedid_njrat_remcos_vidar.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:5640
  • C:\Users\Admin\AppData\Local\Temp\2026-06-27_f30b6e69c465e6a4703a7bc4b751cef5_amadey_elex_emotet_icedid_njrat_remcos_vidar.exe
    C:\Users\Admin\AppData\Local\Temp/2026-06-27_f30b6e69c465e6a4703a7bc4b751cef5_amadey_elex_emotet_icedid_njrat_remcos_vidar.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:4304

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        AppVShNotify.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
        • Size 14.7MB
        • SHA256 c72a631d1e04b11e6e7af4a5b98f98e020abf8176d20727dba6ea7f9b3e9270d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        InspectorOfficeGadget.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
        • Size 28.9MB
        • SHA256 2b8d99b5d3d4b1ec4d09fa2778204a33c994e0c4675be300add3ef6f88fa417a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MavInject32.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
        • Size 14.8MB
        • SHA256 9d748a9a5d60a21d86aaabf0c677f6158b395101e561b7038d18f4d9bdc777ef
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        OfficeC2RClient.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
        • Size 52.3MB
        • SHA256 e310d8aa79c075b81f5996d75b6a3b208142fac27d7929bea9f75137e553fb0f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appvcleaner.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
        • Size 16.5MB
        • SHA256 60339e8933bb563f001bb5fffcb7fa205046c0fef64dd0983a98cf6e42575c4f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VSTOInstaller.exe
        • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
        • Size 28.9MB
        • SHA256 aaf52a27bd76628e6c07255d61b7049b74aa892441ea311ea723cd7aa101ec41
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrmstp.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        • Size 34.9MB
        • SHA256 29a1e0aaea8a668d1a0b6d2b84e43ad75cb3513e80f063a45f431e757a058038
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_pwa_launcher.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 30.5MB
        • SHA256 45f525f41bb8a9c0f3e59c163396e603858c7eccb860b05ed5161f7579c7e8d9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevated_tracing_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 32.3MB
        • SHA256 2054d231efc09f04d72139b4093a4595daeae27f30a7e9bd256f43cd4a23cec4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 31.1MB
        • SHA256 56d20e951880d92c0871982270dfe3aa8d6c391d490f5567c04458bbfcec5164
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        os_update_handler.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 30.7MB
        • SHA256 79a95d665be40548bde79baa75adcc1ba29efe43bd79916ecb4dc63bb93f9a40
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 31.9MB
        • SHA256 6a5d989ac78ad237699f31d2fb8793036d6bcfa6e2f01b009379cfb14189add8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_proxy.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 30.2MB
        • SHA256 6d23e593657419917615286d36ee870e385b15adebefb02b9c0874823ca0fa50
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 28.8MB
        • SHA256 cf561d2fad9945e35ca1930116c54dc5320f4bf7626fa2e5e419796a6d4e3f79
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 28.8MB
        • SHA256 2b7353d435994281a6ff019962e08a63adfe3b5d74a7ce95723dd13abf635980
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 28.8MB
        • SHA256 cf88a58f8a247ce53f67ffd07f39ca66ba801fa35bedde8a811dc31fc3e51339
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 28.9MB
        • SHA256 8d56513829f3ddbc3f1a28fe48d8933c38892d9f3661118275d9aa1bac718af3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jar.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 28.8MB
        • SHA256 fc20d697fb155b6cfa4dc4a9761000db0c08ada54b47c4998bf711b38339c222
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 28.8MB
        • SHA256 d5c96ee64b4397c085d4d1084daae888376c0e2afff27fc142965f86e8649907
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
        • Size 29.1MB
        • SHA256 84a5e6e8972a24d0dbebdf87cd2e3dca14070a6de095c4e418289efd6839e232
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javac.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
        • Size 14.4MB
        • SHA256 a0d58adaac4cea60df97193bb13fe9af5cdf91325e0d639c540fabcce026fc42
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javadoc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
        • Size 28.8MB
        • SHA256 b38b3f0740aeb0259018138172e644ab8ecf578cacca5879a83346ac37a8387d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javafxpackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
        • Size 29.0MB
        • SHA256 9672e1819a7769ab2d0ee07918bffec21f8bfcc9123960df1ffc8f1ec3ae34ad
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javah.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
        • Size 28.8MB
        • SHA256 166ad150e605373552d8cde502e6e41a40ed3b1a7855a655565f0a102231112b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
        • Size 28.8MB
        • SHA256 698741033b5fbf3e9b0f486e49136d5512299790eb4e53a33699ef955c210531
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javapackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
        • Size 29.0MB
        • SHA256 47e4188066920f3617c5f6fcb79501e05d6167893131a9b970b71c316a5a2f6a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaw.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
        • Size 29.1MB
        • SHA256 c4a6691f17b42c04d97e7760083faff00937005c08fd4c63a2d7787b4909b292
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
        • Size 29.3MB
        • SHA256 fa39836f1c2acc4bcae311470c1aa9aa9ea2c14e20058676c0ab78683586d4e3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jcmd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
        • Size 28.8MB
        • SHA256 562428dfb643924472e0ecc94dd644ecb2dd9b218c1956f5c2252c80d7bfa409
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jconsole.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
        • Size 28.8MB
        • SHA256 e5495fe45d3fb17ef76d4d6e97aee98680ee11b096750b0a9bbff8916de8b467
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdb.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
        • Size 28.8MB
        • SHA256 27df7245ffc94f3c016e1b7c0f229690fae55cdf7f049b2aa7c6f372116b92bd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdeps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
        • Size 28.8MB
        • SHA256 6bd9bb45f0408affd49d1e7bc705cafb12f0a41a07e22e904e51bbb36225870a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jhat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
        • Size 28.8MB
        • SHA256 d281dc3172bd416b6480622a20104acf139b9211a9bb16be673b1aa27d7add9e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jinfo.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
        • Size 28.8MB
        • SHA256 c5e967594fea2923a9d6ca432b76d9774770636043a893b9c8efaf3cec64abef
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jjs.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
        • Size 28.8MB
        • SHA256 e9185da139d7f442b0c7cbdc6b29c4cfc5cee66794dde2e6dbd5b986dbbde051
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jmap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
        • Size 28.8MB
        • SHA256 bd04a52cc658c549ece3caab9a6b2d53613321507c5ee90ade1a8fedee1e202e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
        • Size 28.8MB
        • SHA256 813203663a3461c0a17fc92bb5d227d453b4fe17fe762800167cb6c343e3d6a6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jrunscript.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
        • Size 28.8MB
        • SHA256 7594b665d7b6360c92f36fb7b0c40c8185b517c0e5f0ea3425fe35d3382489b8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jsadebugd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
        • Size 28.8MB
        • SHA256 e1731d1994db334453e4215ef8b4bac40377b8dd94af78f1546b49ab7c815e0a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstack.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
        • Size 28.8MB
        • SHA256 e2cd01c73b2875b2f3b2689ec4462739df275402c56c3375553940a709fa3ebb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
        • Size 28.8MB
        • SHA256 904e615839f281fc7929c8732b952a40180f17cf83edfd09c62a6c8e79951eda
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstatd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
        • Size 28.8MB
        • SHA256 dcbf6653335637700861c85d2dd3681453ca3e66e414a76f3f72d2a6467ecc60
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        keytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
        • Size 28.8MB
        • SHA256 5b623e1e60f96d00a83984c4f66dcea82ca342dca6550540c417eb7901aed13a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        kinit.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
        • Size 28.8MB
        • SHA256 560d8288cc2d786cecdc3179c0d66295703e58fd984d0950dab05aa5b38bb873
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        klist.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
        • Size 28.8MB
        • SHA256 5f5452c29f1018d9744f26c05c030c5f528a7530fe302164bd1593e7ab63c4d3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ktab.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
        • Size 28.8MB
        • SHA256 aedcadec83a85181850c983373ff7d3e607252b5b2c1c1b48823c6c6e1f901e6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        native2ascii.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
        • Size 28.8MB
        • SHA256 705412f2d68e882067873e384c1b9850b54f89e562b9d9b3028692eee340fc6e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        orbd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
        • Size 28.8MB
        • SHA256 72be31544b0412a5002ec7f59b04f758337c340015a17466cc92b43c217c80d0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
        • Size 28.8MB
        • SHA256 c5597d0efd6c482a7ce68c66f4e0b9098e5f81a7565f1b3ebd18d125cb256c9c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        policytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
        • Size 28.8MB
        • SHA256 d956654d337aeb8969f18af2aa3fccac9545344807602a426fe6e5469000ff7a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmic.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
        • Size 28.8MB
        • SHA256 ffa41ac258ebae717634868ae29b11394483df6e9c323f6110af2acf037f659f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmid.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
        • Size 28.8MB
        • SHA256 709f872c0f638395065a5950f99b0b66f1ab4b0a34b8e1b11a30fab73c6c37ea
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmiregistry.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
        • Size 28.8MB
        • SHA256 9f28905c1d30eb4769bb2e9b57530447167594bac80c0409c95d677747be7543
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        schemagen.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
        • Size 28.8MB
        • SHA256 537ef29ab164f4b7b104f48f8e45ae6ff440f39cfd3b66a2b2d17c23a486bb8c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        servertool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
        • Size 28.8MB
        • SHA256 b21710bcd2c320b05d64a9a92a6b32e667315a303b33e7779c6b0c61e51fe3ee
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        tnameserv.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
        • Size 28.8MB
        • SHA256 de129d019f26b014684bc76a45771b90e1fe2ab1c7b368179eb372b6de982b7e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        unpack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\unpack200.exe
        • Size 29.0MB
        • SHA256 e779ef10bca626ee68a5d25cea3d73acc34d0dec044053071e53c13dae31451a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dotnet.exe
        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 29.0MB
        • SHA256 d702ce8d253f75f97c8c4ee885258fdc43cf81361b88e78eefe4f656c750d17e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 28.9MB
        • SHA256 5e7b8544a22750fcdc5f6633c69d8d42d32496d7ca0b009fade5bdb0c20cd869
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 1.5MB
        • SHA256 8325bb92f6798c0af3916ef94b488946d69b8b2cf3574d8eb233df9a4bca8832
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/4304-15-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download

        memory/5640-0-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download

        memory/5640-1-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download