Overview

overview

8

Static

static

3

2026-06-27...ar.exe

windows10-2004-x64

8

2026-06-27...ar.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    148s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260618-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260618-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    29/06/2026, 05:39

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-06-27_8049040bc87abae134a2dee67f11de60_amadey_cobalt-strike_elex_emotet_glassworm_icedid_remcos_vidar.exe
  • Size 7.1MB
  • Sample260629-gcefcafv9m
  • SHA256 c47fe2ab3fac38a84615887d25dc25b27482527b3f2d4c24ac91e2e7984ab51a
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
defense_evasiondiscoverypersistenceransomware

Malware Config

Signatures

  • Drops file in Drivers directory 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Sets desktop wallpaper using registry 2 TTPs 2 IoCs
    ransomware
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies Control Panel 4 IoCs
    defense_evasion
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-06-27_8049040bc87abae134a2dee67f11de60_amadey_cobalt-strike_elex_emotet_glassworm_icedid_remcos_vidar.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-06-27_8049040bc87abae134a2dee67f11de60_amadey_cobalt-strike_elex_emotet_glassworm_icedid_remcos_vidar.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:1304
  • C:\Users\Admin\AppData\Local\Temp\2026-06-27_8049040bc87abae134a2dee67f11de60_amadey_cobalt-strike_elex_emotet_glassworm_icedid_remcos_vidar.exe
    C:\Users\Admin\AppData\Local\Temp/2026-06-27_8049040bc87abae134a2dee67f11de60_amadey_cobalt-strike_elex_emotet_glassworm_icedid_remcos_vidar.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:3036

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        7zFM.exe
        • Path C:\Program Files\7-Zip\7zFM.exe
        • Size 8.0MB
        • SHA256 aa0cbd73a53ef418bbdb10e49c5dab1dde1f42877d6b6621232aeacd67e9ecc1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        7zG.exe
        • Path C:\Program Files\7-Zip\7zG.exe
        • Size 7.7MB
        • SHA256 eb4688b201fae9e448d7bb011bb273592c7b3e96d1d3d77f473e8b74d5926b10
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Uninstall.exe
        • Path C:\Program Files\7-Zip\Uninstall.exe
        • Size 14.1MB
        • SHA256 59a340ea9a53007651cee1b0f0e74f5c746819d90b533782f8a58c8a9bdcbf4f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        AppVShNotify.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
        • Size 14.4MB
        • SHA256 a7b4128c8350343c5168e5e844e76a43f2a06bb9d5a89da1e2aa14873e8378b2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        InspectorOfficeGadget.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
        • Size 14.2MB
        • SHA256 7b61a6650368aa72a54144c8823efeea6665072224b924dc19c276223f4b9122
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        IntegratedOffice.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
        • Size 18.2MB
        • SHA256 c96119c77fae1202ccdf94d1fe5de5591d7b67212950da5f23b64cca0c1477b1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MavInject32.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
        • Size 14.5MB
        • SHA256 3ebfe78a3744f848063074b771260e5da6a4f1e339342fed09f33bfcaf1763c7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        OfficeC2RClient.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
        • Size 37.6MB
        • SHA256 1a2a25119964ffe9f834fd338747c74e022f97578c5a22efdfbd7bfc1684fa8c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appvcleaner.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
        • Size 16.2MB
        • SHA256 60a825e39e1d1bad5d6303df9876345b02857ae59380e2e7d6fc857615f5ba83
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VSTOInstaller.exe
        • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
        • Size 14.2MB
        • SHA256 f78d6a2f31723957cd61dcdb67e53416f10c6a7e30df8818a66a7ebfc9806cf3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        setup.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
        • Size 20.2MB
        • SHA256 2e3f6471ed9aeca2a1bd4aa8e9d8872d67c96be851bd68683645c7a267d038f4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_pwa_launcher.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 15.8MB
        • SHA256 cd00f1aa9d4ff53bc94443505baef0269520a64b2fb24c0b7de1ac9f7533f8f1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevated_tracing_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 17.6MB
        • SHA256 2b4c28b2331b7222d02f6700a911d2dd8c18cc27f8ff70203ccc158aff57c3bd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 16.4MB
        • SHA256 d4957932e05bb0c33fa6ed78d4168481d801df86cf0b0fb689d7862d5a6abf7f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notification_helper.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 15.7MB
        • SHA256 91f4b4b08b7b8b9be8d46c56bbf07ffa84d022d5cd491c7431a7e7d87d45ad9f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        os_update_handler.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 16.0MB
        • SHA256 3b8e1115d742f179772998906aa0b2e28fed71a3c76e71035dd75681476f8a9b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 17.2MB
        • SHA256 4f2cf3e277c88a718493051a643660c7eee9fd9508d768ad98c61600505c4ec4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_proxy.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 15.5MB
        • SHA256 70056a13391627698db25b9f118c52239047cd7dade601568a97cdfb311d75c9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 14.1MB
        • SHA256 7a9253a0f7714e5ece4597c4e5a20835f513dceab2fae1a387727190f52e095c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 14.1MB
        • SHA256 7dd77796cbcbb01c105d28a06e8f7ef71d1823223c6f96bff6ee9ede14529116
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 14.1MB
        • SHA256 dc8e53888bb14de1bea6960b7b86a14686d997c9a00b22109ba7b25e30cc9c47
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 14.1MB
        • SHA256 3bb5399198d6325b34846f233a14bda0b6d4248c1400345e3f31cf9edf9802ff
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jar.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 14.1MB
        • SHA256 0c54c739f963aab5b96249fa889948d9ff049afe570869eec8912d9f807c7fb7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jarsigner.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        • Size 14.1MB
        • SHA256 3bb78e02ab1e1177b2b108df1c3873f93dada7d96fc8a1632cfb1745dece18bc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 14.1MB
        • SHA256 d598746843dda3e08cf3e4e994d540297f3bcaa9a0c0d408057425ed380fae66
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
        • Size 14.4MB
        • SHA256 e4644ca6208a450e2a12dcd9c29a6d9126d5b0b6b65d1994de20e233a9dad90d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javac.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
        • Size 14.1MB
        • SHA256 0e704f39b96e0b6980dccf3c1add404ec85579a68f22cf416bc1f43cd99130de
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javadoc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
        • Size 14.1MB
        • SHA256 951bf570c9ab0d54325a4a1bf0ac6da17370654ac37403d7583ba63e8a7a39ed
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javafxpackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
        • Size 14.3MB
        • SHA256 7547d4b9ee7152172a5dcaed8f0d6324f7cd660128116d04e424b45462c74b45
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javah.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
        • Size 14.1MB
        • SHA256 1e37b08f8a3e86c6f1c45978fb0b05c41365d40deaac9c9be6402417d60d684d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
        • Size 14.1MB
        • SHA256 981395849720dacd3bb015dcaf5e1ca8bf0ea775d6d5bf148cec7f944eba23cb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javapackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
        • Size 14.3MB
        • SHA256 dcb312a878a13025ac0e81fc2cceef049227d65565654dfb4f7ad289821c698a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaw.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
        • Size 14.4MB
        • SHA256 bf1ef9e129276a75c3385d88fa894ee439f2c31dc46d6166e772c557bea053d9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
        • Size 14.6MB
        • SHA256 a969e080ba42f9530bf5915578b5885d036f9dd47d38a68642f48f6d3b3bacc9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jcmd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
        • Size 14.1MB
        • SHA256 ca6a348e82a99da7b5e5b7709be0adf1ab00a9c2bbb5a22f5aa3ca38307111c0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jconsole.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
        • Size 14.1MB
        • SHA256 4bb58d68338feb9901f4741f9b3ea4602e7dc7f9d1d3cacf516a1d7d4bd99644
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdb.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
        • Size 14.1MB
        • SHA256 53bf4a24728d108fe2595f691968df910acc0c0e9542c85dfaa52cbbcd7e1672
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdeps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
        • Size 14.1MB
        • SHA256 89fad4d0db411b487a0d65dfc53772844b39c871d3a484bdee90a62f56527858
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jhat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
        • Size 14.1MB
        • SHA256 8436754c62487050117cbb2c9980b3b7968803caed9dbf6844a83b2f590dd506
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jjs.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
        • Size 7.1MB
        • SHA256 a2a7149bd5e34370350d941e3ad6fe49205c7a5898627b93f6b2cb635453049b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jmap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
        • Size 14.1MB
        • SHA256 ae99ff49f4913f711db9d68964564a8afd9f6ade586e48ccaf7dd776f70f3dcd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
        • Size 14.1MB
        • SHA256 a4afdeea6b1ca8b2bf3c9b2ca64aacc8a8a74c14f155154b5311f96284bd3a54
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jrunscript.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
        • Size 14.1MB
        • SHA256 71a0b775d8fe98e63ca5337dca8fe78ea99e307dddcbf5889882bf9470572adf
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jsadebugd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
        • Size 14.1MB
        • SHA256 ad0b4bd323e649249057f7166e4f840e70ff415442fb33fddaeddd1e034bec61
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstack.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
        • Size 14.1MB
        • SHA256 c1860b55d1d7dabe70dfd4be4193daf072830eeb197e60c3cf377b2458ba8bce
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
        • Size 14.1MB
        • SHA256 2db3075aac44b659e9bcd88257462a4ad0dbe902bf1e21328ec37bf57490d39f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstatd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
        • Size 14.1MB
        • SHA256 0cf9f57b4ed4b1f2424d90bc665ff5ff1895a11bb8c25bf51b2cd63740a4c670
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        keytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
        • Size 14.1MB
        • SHA256 30477f9172f9c880b64ed294742c1dd020043f0de18d8977718c63a524212123
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        kinit.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
        • Size 14.1MB
        • SHA256 11315d6848f22a470e8ca898fc4943eaf2b253bb46c2f5bf1d313c19e6100fa8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        klist.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
        • Size 14.1MB
        • SHA256 dd2c73761299778210f45614c8bbadcd9a6d0d0732078884ff432d09398b9f4a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ktab.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
        • Size 14.1MB
        • SHA256 21dfb3add827815562a42da5cfa75e09238f65cbe5084d7b546c37d9a1a86d54
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        native2ascii.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
        • Size 14.1MB
        • SHA256 c79e79758e7b39f007cd4b74344f6f4a8880647f6b00383168034e52898247d7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        orbd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
        • Size 14.1MB
        • SHA256 ce5a63a467a5dd29eaf39d924606cbea3218514d439a2710d04a3aae975979ac
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
        • Size 14.1MB
        • SHA256 15abbcc2a344ba12946e0981558f3ae7b64eb48cf82ef7431bc262702d588cf1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        policytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
        • Size 14.1MB
        • SHA256 e478749cfaecfcf4ba05c56878a8726f81bcc41b6cacde05d00e5e31ca74ae14
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmic.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
        • Size 14.1MB
        • SHA256 473721335faae6a0e76c90b3aa6cb26002d37e8b13f572c413b1cd1b0785e5aa
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmid.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
        • Size 14.1MB
        • SHA256 c56aba6770a3a98acc3d514731c3749c3115d7e9e03e108c28f743598d40d088
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmiregistry.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
        • Size 14.1MB
        • SHA256 9ef921af95f58c6607fd203a399f233be35273b86a022184a0387ce24dcd9dbc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        schemagen.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
        • Size 14.1MB
        • SHA256 bf5963ccd3193e0af7769b5ffa7236e30d1b7742c0ef9e142b582c34ceee818a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dotnet.exe
        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 14.2MB
        • SHA256 d4cda94701b2e1c71bedc816551411608f4082f69f652a2a0684fccc1a06de99
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 14.2MB
        • SHA256 aae48204a7f82280deb158c43a8c195da759079366dc4ccccadc52430a273a8f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 14.2MB
        • SHA256 410c5e6e45509f1e17a150e6bb7bb44ceb4d9c0b67e245f68ad3c5d35784db0c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 14.2MB
        • SHA256 bb22c0609335cb0977e08900fcf1d7c5c21310eed60c10377004f299cc4e9fb0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download