Analysis

  • max time kernel
    150s
  • max time network
    141s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260629-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    05/07/2026, 02:48

General

  • Target
    2026-07-05_29629096b11d221316957af4a326a2b4_amadey_cobalt-strike_elex_emotet_glassworm_icedid_remcos_vidar.exe
  • Size 4.7MB
  • Sample260705-dascmsgx8y
  • SHA256 25cb8b4d54ecdca54f931cfc85e516ebdbeaba4c57532cf966b6dc0a85f61481
  • MD5 SHA1 SHA512 SSDEEP TLSH

Malware Config

Signatures

  • Drops file in Drivers directory 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • Sets desktop wallpaper using registry 2 TTPs 2 IoCs
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies Control Panel 4 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-07-05_29629096b11d221316957af4a326a2b4_amadey_cobalt-strike_elex_emotet_glassworm_icedid_remcos_vidar.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-07-05_29629096b11d221316957af4a326a2b4_amadey_cobalt-strike_elex_emotet_glassworm_icedid_remcos_vidar.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:2932
  • C:\Users\Admin\AppData\Local\Temp\2026-07-05_29629096b11d221316957af4a326a2b4_amadey_cobalt-strike_elex_emotet_glassworm_icedid_remcos_vidar.exe
    C:\Users\Admin\AppData\Local\Temp/2026-07-05_29629096b11d221316957af4a326a2b4_amadey_cobalt-strike_elex_emotet_glassworm_icedid_remcos_vidar.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:2488

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        Uninstall.exe

        • Path C:\Program Files\7-Zip\Uninstall.exe
        • Size 4.7MB
        • SHA256 b834fe8bbd6825b39447a6fb94398ba8b63d4328e6c5bb4732bca90faa616094
        • MD5 SHA1 SHA512 SSDEEP TLSH

        AppVShNotify.exe

        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
        • Size 9.6MB
        • SHA256 41443ce0fdb1542c39b0a1fe27e8c41b40fce9fda68e8ea5de37ac0ff1c07feb
        • MD5 SHA1 SHA512 SSDEEP TLSH

        IntegratedOffice.exe

        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
        • Size 8.8MB
        • SHA256 15a1ca16c7c8bfd946c3a6c7cf19c059116b1d5c93d05c129a1c04b3f3c0ca9f
        • MD5 SHA1 SHA512 SSDEEP TLSH

        MavInject32.exe

        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
        • Size 9.7MB
        • SHA256 9c923231d638fdaddf0e73cf2dc96c43d709aaebb17113c2a6566f0c7cd2c5ce
        • MD5 SHA1 SHA512 SSDEEP TLSH

        OfficeC2RClient.exe

        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
        • Size 32.8MB
        • SHA256 03352b13ebc9f6a9f5297c249b0a64306c47c91474627b102c027935dcd717bb
        • MD5 SHA1 SHA512 SSDEEP TLSH

        VSTOInstaller.exe

        • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
        • Size 9.4MB
        • SHA256 0b8a68e3c390a8569a535c54559b17bd956da6ccf8931dead5b033c169fe58a1
        • MD5 SHA1 SHA512 SSDEEP TLSH

        setup.exe

        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
        • Size 15.4MB
        • SHA256 611fb990e9ad8364a3f867486a6f329f185783e5e7314d3589e4412a795ba935
        • MD5 SHA1 SHA512 SSDEEP TLSH

        chrome_pwa_launcher.exe

        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 11.0MB
        • SHA256 0083e2604c10bd9cb974e4aaaddd3a3ce532ec6de8af7b67cf0204d5ebb15203
        • MD5 SHA1 SHA512 SSDEEP TLSH

        elevated_tracing_service.exe

        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 12.8MB
        • SHA256 33892adfd1abd8a6854d04c1353e17d19fb0bc3075486e4a9e8d16c5eecbf284
        • MD5 SHA1 SHA512 SSDEEP TLSH

        elevation_service.exe

        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 11.6MB
        • SHA256 a54fdcbcf5b97bf3b7f8b4536fadbdd0b88c8c4293fb964fee4b3c08810aa102
        • MD5 SHA1 SHA512 SSDEEP TLSH

        notification_helper.exe

        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 10.9MB
        • SHA256 4c39ea3cf23cf120e99af285bd8ea3f55b46e2d48e3d615288e0d17168b1ce51
        • MD5 SHA1 SHA512 SSDEEP TLSH

        os_update_handler.exe

        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 11.2MB
        • SHA256 6dce05a2b568f80f2c1f79018990236210c95f0deddaee12c4fcf04c7b904c2b
        • MD5 SHA1 SHA512 SSDEEP TLSH

        chrome.exe

        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 12.4MB
        • SHA256 ecd517f3c70730fb65becc4e5617adf17ed4e1817375ad401b6519ad512dea18
        • MD5 SHA1 SHA512 SSDEEP TLSH

        chrome_proxy.exe

        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 10.7MB
        • SHA256 e97242e52cdfab740ea0140eadad0e6e537e0d0a49ed356071bbb722f8776f3c
        • MD5 SHA1 SHA512 SSDEEP TLSH

        appletviewer.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 9.3MB
        • SHA256 7dfbf7880fed94d40360cbbcf2a5e3506e2f063b4e18b84da85e4c63da494985
        • MD5 SHA1 SHA512 SSDEEP TLSH

        extcheck.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 9.3MB
        • SHA256 aa4a439d6e875c7114b30ae16cb7b03fe5a873aa1b8b9f674b792382fc8dd2ff
        • MD5 SHA1 SHA512 SSDEEP TLSH

        idlj.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 9.3MB
        • SHA256 baac5a523fa37304388fffd03e6fc9813ead76894b9e8d90d581136970430b79
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jabswitch.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 9.3MB
        • SHA256 b043a4b9ff4a082a7778e9472b6f90ac0e37801dea98ca703e56685853ae314c
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jar.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 9.3MB
        • SHA256 eda179ec6f5a04190eb258d653c0a87988378fd6af79bad78385b68dc7d7d073
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jarsigner.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        • Size 9.3MB
        • SHA256 5d850f8b66f5954660d6aab09541414565b128c70c5ceaebe00aa3f722a47906
        • MD5 SHA1 SHA512 SSDEEP TLSH

        java-rmi.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 9.3MB
        • SHA256 c203535ad23236ad443142f8ffae593239eecf455232f3ce266d81fd99e1dcb8
        • MD5 SHA1 SHA512 SSDEEP TLSH

        java.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
        • Size 9.6MB
        • SHA256 c3e646a59fc6bf1eb5b71b31b9982584ed25b7caa6d97616b5b7430161f161d1
        • MD5 SHA1 SHA512 SSDEEP TLSH

        javac.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
        • Size 9.3MB
        • SHA256 eeb1232a2a8a36ee546cea036a62cb32e3cd0b79f0c43925c18c213d3d640169
        • MD5 SHA1 SHA512 SSDEEP TLSH

        javadoc.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
        • Size 9.3MB
        • SHA256 025d10b15b33b012e19e36390f5b5af7fedefd36476406d3d479e180360f3fbe
        • MD5 SHA1 SHA512 SSDEEP TLSH

        javafxpackager.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
        • Size 9.5MB
        • SHA256 d3b686d5692e1884b47dba8d9fea16c09de513769ffce2530c1ad966ee16173f
        • MD5 SHA1 SHA512 SSDEEP TLSH

        javah.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
        • Size 9.3MB
        • SHA256 0163e9454820fa6636f56bfca4c11103fc317ae0f14249f5afc8c66964ec389c
        • MD5 SHA1 SHA512 SSDEEP TLSH

        javap.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
        • Size 9.3MB
        • SHA256 4d421b157d4d052329136dc7693e930db2c3fdfa2281560399bd1c36ce5ef590
        • MD5 SHA1 SHA512 SSDEEP TLSH

        javapackager.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
        • Size 9.5MB
        • SHA256 dc150c4c4eb9067d630801e61689c896aed6ed7877704c921885beb9b534172f
        • MD5 SHA1 SHA512 SSDEEP TLSH

        javaw.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
        • Size 9.6MB
        • SHA256 33a4ba6202ce0658f88714c0f5a3bd0d4eb7bcf7293e1b87c525c2546f5b5c5d
        • MD5 SHA1 SHA512 SSDEEP TLSH

        javaws.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
        • Size 9.8MB
        • SHA256 ef67a78a7b41c7d662edb7ef6a5c69b8a676d7650e5b7b5fb05a83d0caf27ce3
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jcmd.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
        • Size 9.3MB
        • SHA256 21f65393375b28088b504a7367173eaf13e942d0bafe3a40a6a16044c965ef7d
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jconsole.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
        • Size 9.3MB
        • SHA256 856be7e3a61da9d781a941f8f8c75546cc927745cfe134b4cb3e9331fef12b1e
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jdb.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
        • Size 9.3MB
        • SHA256 4f0ff66f22b22aa3d356ea4a86b61efab9586add70118f1a2452072dc72ebb76
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jdeps.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
        • Size 9.3MB
        • SHA256 e6a97c18b667d5658cee759f22385571349a014ce3aaf59e9fdfeb10d928aa0b
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jhat.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
        • Size 9.3MB
        • SHA256 7eab401775dfee53a071bb396cc8660296932bd643c32c1380d0f982f0e788df
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jinfo.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
        • Size 9.3MB
        • SHA256 57b17fb04d66d86aecd38dcb2df6c32dc2205996eef408242a1e5ce1fbd19584
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jjs.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
        • Size 9.3MB
        • SHA256 6bbf2bd9e62101190e52b27c9bd17d4350ca7eba416e6b192ee434bb789924f6
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jmap.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
        • Size 9.3MB
        • SHA256 1d995b1c07107bae00b924cabd9ac4e4f89e6e779053e5ce9661e7987eed88ac
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jps.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
        • Size 9.3MB
        • SHA256 f05da8f5807e07e61f537223155be18f663f16f3a81c099db2e1c13ca88c1775
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jrunscript.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
        • Size 9.3MB
        • SHA256 54aca5507c0c9b512eda0e7c4f6f578aaa793ed58051a0715ac8635a375b325a
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jsadebugd.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
        • Size 9.3MB
        • SHA256 9290b2a7406e5d77d2bb8deee7bffd1001b3c9e30986b8bbcd874cd9989450e5
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jstack.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
        • Size 9.3MB
        • SHA256 e5e0482e6f70aaf967fa252ee3abbce3fc4f5ecd8103f1638a8a9c23f5ba30c9
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jstat.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
        • Size 9.3MB
        • SHA256 a4f8dd92678fb669078194209b7604aaaa644b2971d68f2095fd8ab30b73d697
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jstatd.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
        • Size 9.3MB
        • SHA256 34cd0a1eb937fe47dc6447242308e6071576ceb2f4debac6793a33e4610a4c0e
        • MD5 SHA1 SHA512 SSDEEP TLSH

        keytool.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
        • Size 9.3MB
        • SHA256 1a71c0f8cdc0188640b2d3fbbf2620ae49ddda05615350e3a16d9ba31988b090
        • MD5 SHA1 SHA512 SSDEEP TLSH

        kinit.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
        • Size 9.3MB
        • SHA256 6cd9bb8b106b4324eadced8d09fbc21cc9d6f940cd7a3233ae1dbf8050feda6b
        • MD5 SHA1 SHA512 SSDEEP TLSH

        klist.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
        • Size 9.3MB
        • SHA256 1619d276d42c972a04925a2cd55d21837d885ae6a9445ce4c3f4e03be1a21afb
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ktab.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
        • Size 9.3MB
        • SHA256 d352594a86a42b106a14c270a01c1853433eec45f38726ef6d9c4aa4bbf9a7bd
        • MD5 SHA1 SHA512 SSDEEP TLSH

        native2ascii.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
        • Size 9.3MB
        • SHA256 a817a943ca921381ff95d916faba2e16158620246db1df33bdbb0fe5cd060cf7
        • MD5 SHA1 SHA512 SSDEEP TLSH

        orbd.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
        • Size 9.3MB
        • SHA256 cbe93f63bcc831b236ea6cc5df271f9dab9321145921045a1c668e5d272bd953
        • MD5 SHA1 SHA512 SSDEEP TLSH

        pack200.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
        • Size 9.3MB
        • SHA256 93f7c63ebfce49ddf7a91d2bed3944cb28da92ccff553fc74dc7ff60fc8a9aad
        • MD5 SHA1 SHA512 SSDEEP TLSH

        policytool.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
        • Size 9.3MB
        • SHA256 2aaa2c40472330db1daeb9b726ee729106bf1282f4ca007e7308a50d7e3938e6
        • MD5 SHA1 SHA512 SSDEEP TLSH

        rmic.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
        • Size 9.3MB
        • SHA256 001bbe5cd7b88b444f1b701f7a7add0d93cbde7209edb08a28f3878bf0bfd1ac
        • MD5 SHA1 SHA512 SSDEEP TLSH

        rmid.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
        • Size 9.3MB
        • SHA256 f1bdd8a7df928b5cf56eda3c9b67f18fcb08244e229cbda7ef0eb762b9a49412
        • MD5 SHA1 SHA512 SSDEEP TLSH

        rmiregistry.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
        • Size 9.3MB
        • SHA256 a9e4ebb17ee459d9c759b3e9dbe1baae556b636dec10ae34892a17a47af80a56
        • MD5 SHA1 SHA512 SSDEEP TLSH

        schemagen.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
        • Size 9.3MB
        • SHA256 605c32162a0e311d7c1d4b60110c31e2d1fb13ddc1f4bcf94e1343d63d8d0131
        • MD5 SHA1 SHA512 SSDEEP TLSH

        serialver.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
        • Size 9.3MB
        • SHA256 7af2fd729ad137cfe1266d45ff217ad607128a9b947f0a06ac0304bcaad0a17d
        • MD5 SHA1 SHA512 SSDEEP TLSH

        servertool.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
        • Size 9.3MB
        • SHA256 9853c277895b35ff3a41cad83f7635fcd41a66618d0f34f64fbf75596bf71633
        • MD5 SHA1 SHA512 SSDEEP TLSH

        tnameserv.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
        • Size 9.3MB
        • SHA256 70be30735b9285c7e5800243507b243d2ffd5efec56311a95fc4984bfb490f71
        • MD5 SHA1 SHA512 SSDEEP TLSH

        unpack200.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\unpack200.exe
        • Size 9.5MB
        • SHA256 b27778b17f05f102ccc2ce04e21843cb905739b14cbcd703fa7a9798ecd06024
        • MD5 SHA1 SHA512 SSDEEP TLSH

        dotnet.exe

        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 9.4MB
        • SHA256 2449c92ddbe9aa76106763bccfdfefa18b1597d5a64766ccf9d8abcbb3b98563
        • MD5 SHA1 SHA512 SSDEEP TLSH

        createdump.exe

        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 9.4MB
        • SHA256 b6b588222003d88a03d37a0e18f1575f27473e451796eca26fbb8dc41564b913
        • MD5 SHA1 SHA512 SSDEEP TLSH

        createdump.exe

        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 9.4MB
        • SHA256 c25a536c802a99f6586331828929735de4a69de83d32e6acd9794d28958e14df
        • MD5 SHA1 SHA512 SSDEEP TLSH

        createdump.exe

        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 9.4MB
        • SHA256 170b7344fba6a5b94d123aff9f352f9386de8b20902821c218a94930cfdcae43
        • MD5 SHA1 SHA512 SSDEEP TLSH