Overview

overview

8

Static

static

3

2026-06-30...ar.exe

windows10-2004-x64

8

2026-06-30...ar.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    149s
  • max time network
    121s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260629-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    01/07/2026, 02:00

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-06-30_f9e5d465645b36ddd6feeaf501906e0e_amadey_cobalt-strike_elex_emotet_glassworm_icedid_remcos_vidar.exe
  • Size 2.6MB
  • Sample260701-ce5m4aes3w
  • SHA256 439747be478c14f7102617e4a12e4394641b7f5593ba048bceb5d4dc9a142be9
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
defense_evasiondiscoverypersistenceransomware

Malware Config

Signatures

  • Drops file in Drivers directory 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Sets desktop wallpaper using registry 2 TTPs 2 IoCs
    ransomware
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies Control Panel 4 IoCs
    defense_evasion
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-06-30_f9e5d465645b36ddd6feeaf501906e0e_amadey_cobalt-strike_elex_emotet_glassworm_icedid_remcos_vidar.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-06-30_f9e5d465645b36ddd6feeaf501906e0e_amadey_cobalt-strike_elex_emotet_glassworm_icedid_remcos_vidar.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:3772
  • C:\Users\Admin\AppData\Local\Temp\2026-06-30_f9e5d465645b36ddd6feeaf501906e0e_amadey_cobalt-strike_elex_emotet_glassworm_icedid_remcos_vidar.exe
    C:\Users\Admin\AppData\Local\Temp/2026-06-30_f9e5d465645b36ddd6feeaf501906e0e_amadey_cobalt-strike_elex_emotet_glassworm_icedid_remcos_vidar.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:4080

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        7z.exe
        • Path C:\Program Files\7-Zip\7z.exe
        • Size 3.2MB
        • SHA256 d63fdae61a94afc57693621dd6a88241f170ebeadd3f84d19f9f17542d0412cc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        7zFM.exe
        • Path C:\Program Files\7-Zip\7zFM.exe
        • Size 3.6MB
        • SHA256 55691967ba385adf133ab84230f1a64b10b15cac6069e85502236a40b93bbe3b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Uninstall.exe
        • Path C:\Program Files\7-Zip\Uninstall.exe
        • Size 5.3MB
        • SHA256 3ebcb8e45c19f0043fa6649f2e0fe2829d286205a6689ece5068f08aff2602f9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        AppVShNotify.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
        • Size 5.6MB
        • SHA256 bf8a507e9cebf4184f5407782af2da802f9466dfd104dd2ec482279a395866e9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        InspectorOfficeGadget.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
        • Size 5.3MB
        • SHA256 48673c0a2558c83786c08c67ac57914ed2bb90eaec41f5cae4861aff0a0d5030
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        IntegratedOffice.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
        • Size 9.4MB
        • SHA256 67e768cea1d57e786ca95b009195f652e5ff699a864c27cd4ebab7ae1707ccd8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MavInject32.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
        • Size 5.6MB
        • SHA256 1824c4112df90df336aae721ef73fceb1b7551ee4abe453f46384bfe76a1e94b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        OfficeC2RClient.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
        • Size 28.8MB
        • SHA256 f8c95891364d7844a6a802536cebae387bb023e796c3a35ad6b8a1883f5136d2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appvcleaner.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
        • Size 7.4MB
        • SHA256 5c03a1072b5106910bb97a3f1d55973c46a2f798a4a1894358fa33a28744d09c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VSTOInstaller.exe
        • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
        • Size 5.4MB
        • SHA256 6e1597ba4ce997880cca026ac99555badf782e27ad13d71a161c82974cc974ec
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrmstp.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        • Size 11.3MB
        • SHA256 d7a50974ff27324b2a120236ad4da9425a04559527114c098f67d63fe27fe9ed
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_pwa_launcher.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 7.0MB
        • SHA256 0326df8e2cc24e6a5964657b21905cc90367430444009385398c853de1573171
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevated_tracing_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 8.8MB
        • SHA256 ff719ec889624cb8bc2c7142c90e42f3f452be8cf81c9e295bbbeb480814ee3e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 7.6MB
        • SHA256 d7df329c7d259a7c82303162f07e3e14a6827d663f226c7ac6d2034a5beadc76
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notification_helper.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 6.9MB
        • SHA256 bb31bd129d0035482ac5c3ace6d3b2e957072443289c35fb7fd65a73acf49d1a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        os_update_handler.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 7.1MB
        • SHA256 4f60e7791110b6547e410e520392662c45ab8dbb4c14b66d6fc9f84a4d40aef9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 8.4MB
        • SHA256 ef9353525a8072f02804b16d8057bca69ed2a3e719230a9074454eb9741bcca3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_proxy.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 6.7MB
        • SHA256 8e0221592936fb2cfcaf16e6896aeb0b588aefc9bae3090076de8d189e632207
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 5.3MB
        • SHA256 919590860e770d048f52169e7fde089cdbc50d719f1c1ac50573602bbc11c5db
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 5.3MB
        • SHA256 601b247b1f5a6322c4a74f5ce9f44a7168fc831e258024cad46ad3bcb0a79ed0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 5.3MB
        • SHA256 b0d313226b9da2e350ccdd78c1c5657e8f56921516570ca4c3e72cbbc3430b7f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 5.3MB
        • SHA256 187f6f6674a20d75fcf7e912c73a496b72e992b8296baa21bf2b688fb4298f97
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jar.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 5.3MB
        • SHA256 61473ab83642b0d89e74d7b931a50b082ca2db698abd50e56f54ef957f6e7d9c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jarsigner.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        • Size 5.3MB
        • SHA256 805fed69e04a70899747523893615998b550e8a15971ceb50269ef10df32814b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 5.3MB
        • SHA256 5916c63368937def4a078357e932ff21f62892582d749ef06920d8f7ea3293f6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
        • Size 5.6MB
        • SHA256 6a011629bd71bdf659600e67ece53ad224b39beddaf4f310385eca9370acb444
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javac.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
        • Size 5.3MB
        • SHA256 74f4da1c9ca6288bf147859efae9c46c8b1f8870d5fc1828c2833e816dce466e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javadoc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
        • Size 5.3MB
        • SHA256 9550d8ec8f8ef0e61b3a0c8288173eabefd4137168e35837eae8c6ebeee65d2b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javafxpackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
        • Size 5.4MB
        • SHA256 ea78bdea8aded52dadcb8a6a8bdcdc39e23a9836ee9b4302c27d42eb015d617d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javah.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
        • Size 5.3MB
        • SHA256 89e7c71bd393804b31a8a3ea34d183c52b53500462b1aa7f1189e23064ff68e2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
        • Size 5.3MB
        • SHA256 8ef913d321077d41b27d4851fd9af3643bf26cd865d2f56229d70f3b7eaa4da7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javapackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
        • Size 5.4MB
        • SHA256 7ffbf1cd9a8966d64ad1a37c1e0386de762ff60258d963ff96701d2c6ea3f194
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaw.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
        • Size 5.6MB
        • SHA256 2aefba19891c5c351ba387317a3e7f58127775726bf060752f1c33cca46ea139
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
        • Size 5.7MB
        • SHA256 70b4b43df248d7043477c027e2a91bd6590feb3befc70aa0e13b8a93742bc4c2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jcmd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
        • Size 5.3MB
        • SHA256 f2746d096991ea0b1622daaa8f79ec8b2ebd3426e564a6624c2427cbab3fb511
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jconsole.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
        • Size 5.3MB
        • SHA256 3820eb0b626c5c407daf512e2415067928af27fa1241c37cea051157435bee8b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdb.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
        • Size 5.3MB
        • SHA256 191d8b61c7fa369396f3ed7cc83a77bf022eb2a45e7a7ed234b9614ac144c799
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdeps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
        • Size 5.3MB
        • SHA256 d58b8299d155e737d2fdac36b10b52ffef25ae204d34c9fa58b77a87f0dca6c6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jhat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
        • Size 5.3MB
        • SHA256 bef7a8433cf96bfd45c49ccf0a3b86e5003f22dd0319feaf52b5628319dafed7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jinfo.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
        • Size 5.3MB
        • SHA256 f1e95a908d31ab76b0d1d71162b670342e5f52b1de8cc039f7888f45eb7140a6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jjs.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
        • Size 5.3MB
        • SHA256 16effd9c8525eed7018a1a41847c3e1c00ba84a4355d596ad2c52cffa422fa04
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jmap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
        • Size 5.3MB
        • SHA256 5fecfccf791af7d1b0e3d4381ef63eca54b7c25cfd16aab4a9fd816646bfb3c9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
        • Size 5.3MB
        • SHA256 9e699492bcf3ecf89f2f6aed05ed354dec53b41752cd0fc38244ca5de8ab4106
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jrunscript.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
        • Size 5.3MB
        • SHA256 aba435f5945c8bf3c7c7ee4667cac21c5eee517987ed58869ba01bdb74e0c070
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jsadebugd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
        • Size 5.3MB
        • SHA256 5f462a0551a7ffaa2aae1ffb9101c695c984f2d9f882c465b83cd3f44889288a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstack.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
        • Size 5.3MB
        • SHA256 be2d1fd36d514e741395b36ba294aa39881bdece69ad1771a6f8701b9b4fc329
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
        • Size 5.3MB
        • SHA256 79f9563e46532042170ba89300cd6624d85ea17a7c2ba18e3ea31d28b96cee56
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstatd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
        • Size 5.3MB
        • SHA256 5065c079b2f7bd82c70ad63ee8529ce9a6af3d0f71825ad77f71ade9d748cc56
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        keytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
        • Size 5.3MB
        • SHA256 9ab6d594a782083c5791414d0d87b4389c0cce4b94e1b9e2426bf91353e69604
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        kinit.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
        • Size 5.3MB
        • SHA256 e142762612754172d4045d410aefabdcfb52ced961654cf6338d3233cc4c9cbf
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        klist.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
        • Size 5.3MB
        • SHA256 18852bc6f05983bdddd8b840a766bd6db7ed65a69f2a946bb40bd01ba904921f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ktab.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
        • Size 5.3MB
        • SHA256 eba983d4a351d422a8067d9b904c45634041694ff6a7d2b84e122a8db9b1e25a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        native2ascii.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
        • Size 5.3MB
        • SHA256 dc9f6193f43b108d2a0f96303c331a8277f5ab49a26fdf15d17189112dff9818
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        orbd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
        • Size 5.3MB
        • SHA256 939a047462309de233d562d86deb1aaeac7ab0cd4956c5d537c4ae96c4fa2741
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
        • Size 5.3MB
        • SHA256 3587deed1eb4f5e2ed4a57a7426d20b44862a8da18c4a3dc3a629cb8906c1b69
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        policytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
        • Size 5.3MB
        • SHA256 e76e0ab5d2066436076e8c6ec14c97a4b942feeed46c52f149d3ec326d7949f5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmic.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
        • Size 5.3MB
        • SHA256 339ad98343b68c189608feb8e090fab23876506978d3349f4443a891b1bc6750
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmid.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
        • Size 5.3MB
        • SHA256 bc69f167ce332976366469b10b905b59a95059a95207ef903684eebcd139fbac
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dotnet.exe
        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 5.4MB
        • SHA256 9a6408761267c5402702df7bceb082a7b1dd4fb1bd861f6295788fc667bfaacc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 5.3MB
        • SHA256 8cb5d0659088efdb378d62e2d85944b427ca59221172c6de8efb292bdca6bf37
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 5.4MB
        • SHA256 4fe3c0e8d49d92930774331d09a2945980ddc3b661e570e1073ab1e04888a15a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 5.4MB
        • SHA256 1870aa726be96193bb393e03fa40f1c08d0a8629519e14145aaaa25cbe8feb29
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download