Overview

overview

8

Static

static

3

2026-07-01...ar.exe

windows10-2004-x64

8

2026-07-01...ar.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    149s
  • max time network
    128s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260629-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    01/07/2026, 19:58

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-07-01_16d5afcf45d36a75fffa838e3ed69530_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
  • Size 10.3MB
  • Sample260701-ypsbeady6q
  • SHA256 5ee9b602beb0f10da6d7035258c33732a298f01a2e3cdb3dd12831c796b3cd47
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
defense_evasiondiscoverypersistenceransomware

Malware Config

Signatures

  • Drops file in Drivers directory 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Sets desktop wallpaper using registry 2 TTPs 2 IoCs
    ransomware
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies Control Panel 4 IoCs
    defense_evasion
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-07-01_16d5afcf45d36a75fffa838e3ed69530_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-07-01_16d5afcf45d36a75fffa838e3ed69530_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:5764
  • C:\Users\Admin\AppData\Local\Temp\2026-07-01_16d5afcf45d36a75fffa838e3ed69530_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
    C:\Users\Admin\AppData\Local\Temp/2026-07-01_16d5afcf45d36a75fffa838e3ed69530_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:1608

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        AppVShNotify.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
        • Size 10.5MB
        • SHA256 761a6eef8e18ae36daa7d28bc07192c590025372b9b8358773b543f0b553fce7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        InspectorOfficeGadget.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
        • Size 10.3MB
        • SHA256 19869dd0c14d1aaf290ecdf0c2d931987444af28d79f95326e0332934103d443
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        IntegratedOffice.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
        • Size 14.3MB
        • SHA256 e76d9c161fd0c902830d34815e49e9026a116d4cb70d9dc18858c4687fd30bd8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MavInject32.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
        • Size 20.9MB
        • SHA256 2db4e82453650dcbd2f3f2e7d06cd9fbc2804a995c24110e0b92a1d8fb721754
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appvcleaner.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
        • Size 12.4MB
        • SHA256 6c37057f07bc50d3751546d30d8ff13b90871a6fc8ab367077b4ef678d1ae53b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VSTOInstaller.exe
        • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
        • Size 20.6MB
        • SHA256 e7e4e475efea102a4848d4c07cf3835fe0b5c0d3e2e676911141171099c3b6a7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        setup.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
        • Size 26.6MB
        • SHA256 99185fcbb403cd5e9ab16e6595e9296b68ce515ec18520818f6a2ab51ff0f854
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevated_tracing_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 24.0MB
        • SHA256 705d3248841ef86aaca068334ade7be66cee4d5b607fbe98613774fc4936ef7d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 22.8MB
        • SHA256 58238331e6c762d1a9171f75958962a79930fcf726c9581abd47711fe94b3414
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notification_helper.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 22.1MB
        • SHA256 c098190662fd9811c8a5d5c4b0bc7a3a431beea227501b332acea8667f29abe9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        os_update_handler.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 22.4MB
        • SHA256 8a32303b53e103868a8d2cbedc3e9757b97a844391e0acd01f28004b2d071aa0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 23.6MB
        • SHA256 ac0e4e430d8f07ee4f45c0c46901104ea069fabf539bc6aa2294a29b6726afa6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_proxy.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 21.9MB
        • SHA256 e1df4745f8d5c8878b74b48941ee405638f6e70e991bfbe8cc80aaaa6824bd1f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 20.5MB
        • SHA256 de468183ea63ad079214a2a198aa57ae0d3b7410c5308d8f9589cf4d98987d58
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 640KB
        • SHA256 8fe8c9833760a8bd2f527537fe17d0772f31ab61d2cd9bf30c370f983807b607
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 20.5MB
        • SHA256 4bdbeb07ebdcac739a453f85bdc7c8bf068f9e508f3f560163d6b438209b436b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jar.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 20.5MB
        • SHA256 087aea5aafe3ae03810fcb75807cc573c954423b7ec0d80034e12fdcafb8281f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jarsigner.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        • Size 20.5MB
        • SHA256 84e0ecf6ec641f6e37cc41eebc594d0c9a0b560231e91cab7fc063df65f935a3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 20.5MB
        • SHA256 b87862355cd413e5685563bb84364206f5335d609c2e7e8bcfdfe5a058fa5c12
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
        • Size 20.8MB
        • SHA256 91fadf3091af5b09bb8f33d43021f90ada6b66d41b869b72d4d868803ed8d9a8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javac.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
        • Size 20.5MB
        • SHA256 93005b18cc1a0cf4bd2a563c3620d84186ddfd3392204b7ad0f5e6c0726c0647
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javadoc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
        • Size 20.5MB
        • SHA256 c225fd002491e9cb6d31a41171e9931af0501bd3cd1ecb0d7698a5910a3e7198
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javafxpackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
        • Size 20.7MB
        • SHA256 7b687275cfcc53eaa2464ac78961c5eb1be2f8d2f9458319e26ef24941c22aa0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javah.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
        • Size 20.5MB
        • SHA256 328c8077c6b9856a9af67b1b62e9a9436e8ff34d8f42059efbecbe39050d45ed
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
        • Size 20.5MB
        • SHA256 d13304a3c91dfe0b579f40bdcfff9ad9aa80ff560f1343b1aca441f5db207d8b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaw.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
        • Size 64KB
        • SHA256 d2eb08ebe0c7e7ff2223b6feb8c95f679251883e0b850d913bfa4b604432b861
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
        • Size 21.0MB
        • SHA256 2d3185e109045df747f6497a03f2cb4e77d68badcaf38f2625ad0fbf3647c1b9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jcmd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
        • Size 20.5MB
        • SHA256 4ad23547908e25530749b3e6eb8f6a2e682aa91a906386418bf125f86e5db754
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jconsole.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
        • Size 20.5MB
        • SHA256 e5e24419743f22ba461599b8f88e01051b4675993c8d4f6b6eb7e779838ac4d9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdeps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
        • Size 20.5MB
        • SHA256 d753c6a36e753b66c7b89392449b5abab7abbed2a75372efc2b7cf3071d79b47
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jhat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
        • Size 20.5MB
        • SHA256 77b73360e49dbfb3df558beee0ce0811287fb31359f56df617651f0dd515d0d8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jinfo.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
        • Size 20.5MB
        • SHA256 beb0b6d22c8aee87b41002358cb21b9845ae5046d66fb8867e00727d8be96383
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jjs.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
        • Size 20.5MB
        • SHA256 63bd06135a09435d5b0568199d66f8b8ad68ad9abcf1c32bc9d491cd0b552bc0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jmap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
        • Size 20.5MB
        • SHA256 fc84120356630450d65ec4002bcb93b859aa344af5c79ca55b006777596110ac
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
        • Size 20.5MB
        • SHA256 f889532fce36bb1cb9374396b5ff34af22d2ff4c32e0b2aefc43cfc146e81074
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jrunscript.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
        • Size 20.5MB
        • SHA256 27d831a62f56793551ce7898d6600d5d7464e5af8fa9123d5c0f9f5eb5ff873b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jsadebugd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
        • Size 20.5MB
        • SHA256 bf0e46505286c661b3eaf49b07ea356cea10ac4de583fe8cef656ed9375d3df0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstack.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
        • Size 20.5MB
        • SHA256 d0f7e474e9f7e7214086d52d2da2c0379721eea8b932e6fbc14f7990d5c26ad5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
        • Size 20.5MB
        • SHA256 fad3e3efa465c57d5e2b4db379c5ebe964921216d6f0e48ccf8965c6281a18e6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstatd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
        • Size 20.5MB
        • SHA256 0512ca08b4fe0c6ee48493ffb2ca1a2c336ba0717caf7d635e7eb765c186bacb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        keytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
        • Size 20.5MB
        • SHA256 971e7db5cda2dcc01cf354618e70b619db42a65d21c0b7c9d0d6aa0a7f3e1fd3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        kinit.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
        • Size 20.5MB
        • SHA256 0220d0c275b59845141b24cb4e32a6d52648328e571d16af286a2a978d914d8d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        klist.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
        • Size 20.5MB
        • SHA256 ca7066a358f711c5336b7ca5b13eff9a4d9705cb58c3f3da1524ab3eee305021
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ktab.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
        • Size 20.5MB
        • SHA256 d1270e634f298a96f559efcbde8e5dd2060841dea4a0b81cb7c435bfc88c1826
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        native2ascii.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
        • Size 20.5MB
        • SHA256 056388720eed29e1cf48c7f685bba26ed3f40beef7269a429ad7493b98eb2cd8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        orbd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
        • Size 20.5MB
        • SHA256 db3d5715d9f69bbae0a21c7073b96921e45cf87bd9df36a941d504a4fb81b6b5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
        • Size 20.5MB
        • SHA256 09936d3de3cf18c1ff16c01d119eb8a1e839adca03f0e5218d14a58947317d4a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        policytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
        • Size 20.5MB
        • SHA256 5fec2b69136d4d910131ea5f7e28d765d104f1dcd3414dda9c1f20265e0ee5e4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmic.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
        • Size 20.5MB
        • SHA256 b1d1d89cf55ac51021e84d031035c32f3758a9e92d3039fbe41fee24866ed3c0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmid.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
        • Size 20.5MB
        • SHA256 c4ef5e237a5a56bf46386fc3c5650ca379e78fa6623e08383c7f6515621751a3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmiregistry.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
        • Size 20.5MB
        • SHA256 d03523b453e3bf15bd90b4f68f62ef6f2013b5b8bd356c914e333b4c97756663
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        schemagen.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
        • Size 20.5MB
        • SHA256 78f65f077b4dfaf3523c84e22f220faafd0f35cd1c12f279e959a17d89e7c731
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        serialver.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
        • Size 20.5MB
        • SHA256 935f2f70fe4f13dcde80e25e6eae2c3028ccacbbccce72b6274f098aa842ee7f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        servertool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
        • Size 20.5MB
        • SHA256 70ae244136e33a26e3168def083040fa4f043e5fd8150336d95eb664ef12cd47
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        tnameserv.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
        • Size 20.5MB
        • SHA256 b7e7395a4b22d8b1605df4f3ac3e15d171c3b7d9d4ed9f1a570d0371eecd8d9a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        unpack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\unpack200.exe
        • Size 20.7MB
        • SHA256 7f4f5ff083252aea7134ffd03a9fe8ed8a19b1637d2f90052d881dd9eb3e1e52
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dotnet.exe
        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 20.6MB
        • SHA256 c0de22ac52525a19877d1529a0e617c59172a6823690c67fc92ff0630a136e7f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 20.6MB
        • SHA256 1365fdeb63b74b2cdaa676e4d37b90462c16a6c7a1f6e45e32534992db989244
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 20.6MB
        • SHA256 3de77112e5f5efe63bf8f6fdca60075c1b05fb0ca1f706579694942f85fdda9f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 20.6MB
        • SHA256 9bd157ada31b2daecf3b2e8d926f5964425f4abf70e3f725b5ea16397a4f1bec
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/1608-10-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download

        memory/5764-0-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download

        memory/5764-1-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download