Analysis

  • max time kernel
    149s
  • max time network
    123s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260629-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    05/07/2026, 03:47

General

  • Target
    2026-07-05_5c301a0b2d1ac0b1f81bbc79b199fca2_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
  • Size 15.9MB
  • Sample260705-eb878acy6r
  • SHA256 40a8e1f9fe7e2f93a7c5a1a97c815a5b73c043b593873b388d5ff9cbedbc0834
  • MD5 SHA1 SHA512 SSDEEP TLSH

Malware Config

Signatures

  • Drops file in Drivers directory 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • Sets desktop wallpaper using registry 2 TTPs 2 IoCs
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies Control Panel 4 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-07-05_5c301a0b2d1ac0b1f81bbc79b199fca2_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-07-05_5c301a0b2d1ac0b1f81bbc79b199fca2_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:1152
  • C:\Users\Admin\AppData\Local\Temp\2026-07-05_5c301a0b2d1ac0b1f81bbc79b199fca2_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
    C:\Users\Admin\AppData\Local\Temp/2026-07-05_5c301a0b2d1ac0b1f81bbc79b199fca2_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:3932

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        AppVShNotify.exe

        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
        • Size 16.1MB
        • SHA256 e8a918c489a02eca43eb970c734a986cab3c9d143d807bd190b4b391e7062439
        • MD5 SHA1 SHA512 SSDEEP TLSH

        InspectorOfficeGadget.exe

        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
        • Size 31.8MB
        • SHA256 7a929bfe62fb22e6c40d1a078f347de980cda2509f36e771384f0bdf5a5fbde1
        • MD5 SHA1 SHA512 SSDEEP TLSH

        IntegratedOffice.exe

        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
        • Size 35.8MB
        • SHA256 cc42c01cdf84627cf21d801558c0b4a1b85e67b94df4d116c2aaf5f7d476443f
        • MD5 SHA1 SHA512 SSDEEP TLSH

        MavInject32.exe

        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
        • Size 32.1MB
        • SHA256 55cb1e0fc8aa7a7e8cbdfbc03ca0b24d3ec3d242b28ee42ec9e9314363cd74fe
        • MD5 SHA1 SHA512 SSDEEP TLSH

        OfficeC2RClient.exe

        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
        • Size 55.2MB
        • SHA256 887289ae4eda4492fda73b2ddf047ba3a98ad598affe672476b346f9f1f309bb
        • MD5 SHA1 SHA512 SSDEEP TLSH

        appvcleaner.exe

        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
        • Size 18.0MB
        • SHA256 5c10aed32b80f3b67f413219ad0fb9e6523848a2f577a33f73fbd7936f7417aa
        • MD5 SHA1 SHA512 SSDEEP TLSH

        VSTOInstaller.exe

        • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
        • Size 31.8MB
        • SHA256 365c5c32b2920231c7454205ce33b0cb5f4126dbc6046f7323d28d732619fef4
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ExitSwitch.htm

        • Path C:\Program Files\ExitSwitch.htm
        • Size 32.0MB
        • SHA256 e9d21b90e9353e0a9e0a7478d350c10ea975f2af6ab81c2343cfd3803294e0b6
        • MD5 SHA1 SHA512 SSDEEP TLSH

        chrmstp.exe

        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        • Size 192KB
        • SHA256 c61d5a2b5856b5a273a4b636240fa277afc38dae069b227c270bb7f4cb23e995
        • MD5 SHA1 SHA512 SSDEEP TLSH

        setup.exe

        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
        • Size 37.8MB
        • SHA256 21db189a0321279a3e9b615692dfe7490715816b0bc3b7a60e4034b4e6cac0d3
        • MD5 SHA1 SHA512 SSDEEP TLSH

        chrome_pwa_launcher.exe

        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 33.4MB
        • SHA256 b63992fbde87d9086710e2298674378e76901288f9346e60e3738f1bc4bfdb35
        • MD5 SHA1 SHA512 SSDEEP TLSH

        elevated_tracing_service.exe

        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 35.2MB
        • SHA256 2290756f625a37f3de66054577cd5a5a39d1f3ce4c6e78b9ece91fae94e8aa67
        • MD5 SHA1 SHA512 SSDEEP TLSH

        elevation_service.exe

        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 34.0MB
        • SHA256 58826f050f47d0f153ff50caf9326165c5d8e9085bd6294ed4574851ec449181
        • MD5 SHA1 SHA512 SSDEEP TLSH

        notification_helper.exe

        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 33.4MB
        • SHA256 da8fbf88a314edfafdf4738e87cea4b6bce396a43bb36e4d36dafadd3831886d
        • MD5 SHA1 SHA512 SSDEEP TLSH

        os_update_handler.exe

        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 33.6MB
        • SHA256 8ed463b6d680db31f2afe9f46aa54c37373f5d16eb51c779986dfcb7dff050c4
        • MD5 SHA1 SHA512 SSDEEP TLSH

        chrome.exe

        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 64KB
        • SHA256 561e710c0f12a9ecf3c544ad6eaf227983f3f3f2dcce0bb2f803afccc641ad14
        • MD5 SHA1 SHA512 SSDEEP TLSH

        chrome_proxy.exe

        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 33.2MB
        • SHA256 f63a5ba45ac304edf93942c558f873a2255c33051ffad947b3b0177ff5c9a626
        • MD5 SHA1 SHA512 SSDEEP TLSH

        HideUndo.asp

        • Path C:\Program Files\HideUndo.asp
        • Size 32.0MB
        • SHA256 c221057af040158bce3a375956cf953c676f7ec4815ab0cb63bc39040fd7b47f
        • MD5 SHA1 SHA512 SSDEEP TLSH

        appletviewer.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 31.8MB
        • SHA256 05658e5dbf65cbc5ed23f2e5f442801ed322e4c0803f4a84add784dc047a4c52
        • MD5 SHA1 SHA512 SSDEEP TLSH

        extcheck.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 31.8MB
        • SHA256 2580fea952673413ada9711047e1626454da906f85dc5afdc665a1818bab9e03
        • MD5 SHA1 SHA512 SSDEEP TLSH

        idlj.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 31.8MB
        • SHA256 4783e30a2fd8318b649f48ea993bf68246b7c36dc1ab0ffcebb450f40b3489a4
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jabswitch.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 31.8MB
        • SHA256 32e36192b34b2b3f57537440eecdec84d7fcadcc3d7f8031d98d604f12c8906c
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jar.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 31.8MB
        • SHA256 48b45ab696394ed05dfbc91c0e443a273342b016b8a0f29a0e8acdc246c277d7
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jarsigner.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        • Size 31.8MB
        • SHA256 efa620dce0d79b39e581da4a4de40b93b1c533146cfafc8cf1ec5407afe20d72
        • MD5 SHA1 SHA512 SSDEEP TLSH

        java-rmi.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 31.8MB
        • SHA256 d8b894d894ed90a15104391f23afb3c090f17a1656f8a6bb21a25d8bdc85df4b
        • MD5 SHA1 SHA512 SSDEEP TLSH

        java.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
        • Size 32.0MB
        • SHA256 c8045b9c1746bcd596a9ad0312be78ff3d366b41b469c17ad289c541749a5689
        • MD5 SHA1 SHA512 SSDEEP TLSH

        javac.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
        • Size 31.8MB
        • SHA256 258bf8b6ee36de5ba1cc93fb16d8c6bd79dfce821cf984fbc6f3e1aae832bad5
        • MD5 SHA1 SHA512 SSDEEP TLSH

        javadoc.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
        • Size 31.8MB
        • SHA256 bcac6d4966442a580105bfb32d10c8d27eb539c2b1fae346c354e3d121b25128
        • MD5 SHA1 SHA512 SSDEEP TLSH

        javafxpackager.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
        • Size 31.9MB
        • SHA256 d3b9dfb3fbeba6e56318dc4fa39025687fc4c3b251ab88847400bf7d5b3aab24
        • MD5 SHA1 SHA512 SSDEEP TLSH

        javah.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
        • Size 31.8MB
        • SHA256 4a622233ebde04c5b429069ad21085f087641fd8bfd8d7c1fa5feabc4cc8b6b3
        • MD5 SHA1 SHA512 SSDEEP TLSH

        javap.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
        • Size 31.8MB
        • SHA256 100602954b64296da140d5af572cca62a0ee84261c1b656e1b17ddd98047d156
        • MD5 SHA1 SHA512 SSDEEP TLSH

        javaw.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
        • Size 32.0MB
        • SHA256 3e268d3dd42dd9c27e07a7bfff075a190c7861f38a38671159082f100562f888
        • MD5 SHA1 SHA512 SSDEEP TLSH

        javaws.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
        • Size 32.2MB
        • SHA256 007f144b1b251114b7f4e8c00654ab93d891e0073d9a04d836ad2f9fc1afa9bc
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jcmd.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
        • Size 31.8MB
        • SHA256 b4e41aaf3c6dfbba634785ba2603016298739244429a62c80d5cec050a625ab5
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jconsole.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
        • Size 31.8MB
        • SHA256 5e4630d9216cb730d004a194bc9f1edb113e868cc4fcc8df051b623fd4d4d1fc
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jdb.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
        • Size 31.8MB
        • SHA256 397387670d5a744a966ab78e100ac202f691a71faeb8f48a192537b586cf4598
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jdeps.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
        • Size 31.8MB
        • SHA256 7022c8c9ba756ae8b4ff43dc8c540e6057e2249b404f4d959b8c535d73e21215
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jhat.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
        • Size 31.8MB
        • SHA256 e88206520d1b2bbe4f49ee90a615c95dbb04cb3b7ff30d118190b52abc6986b5
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jinfo.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
        • Size 31.8MB
        • SHA256 8fd0f30f62660d21988a5ca530b07f0725b4d7f2ca5516bb5de2e6f3f9abcb60
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jjs.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
        • Size 31.8MB
        • SHA256 77da2a6f2e3e66823100f1cf7015fc96a723c73f94e13ff8296f2f313ca79e54
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jmap.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
        • Size 31.8MB
        • SHA256 4c0a81e5557fe5aeb93e3779d223c05904491a035bfeb31e5c304b48b2d611a4
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jps.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
        • Size 31.8MB
        • SHA256 a49bae66584f6f876eb7c6a905cd68081cf8be3020fe417d0708aa0383fe2dd5
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jrunscript.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
        • Size 31.8MB
        • SHA256 0fa16d0a8833b91079761e22eafe77faf322d366f9d1f442a3c826474b55371f
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jstack.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
        • Size 31.8MB
        • SHA256 314374c300806983aac29a8b3053cfa029d97e21831aebe10ac9cd63e8963a3f
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jstat.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
        • Size 31.8MB
        • SHA256 9358dd8fc362148a7fc5100953051e140c5ee12c85a4e9979dd4737efe5c6c89
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jstatd.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
        • Size 31.8MB
        • SHA256 e5badc8e1eb7c980020f3cc734a281a501c8f97d4a72318747b6e158f7e2bf31
        • MD5 SHA1 SHA512 SSDEEP TLSH

        keytool.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
        • Size 31.8MB
        • SHA256 4bc426b030e1dec57de46341748d4922d1b0962500c89a75afd6db2f983a373c
        • MD5 SHA1 SHA512 SSDEEP TLSH

        kinit.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
        • Size 31.8MB
        • SHA256 fa5472f0b732eaa82491bdd0cc7dfea1b7e94b99bed8a2fdabb4ecb50dee3599
        • MD5 SHA1 SHA512 SSDEEP TLSH

        klist.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
        • Size 31.8MB
        • SHA256 e3dabdf8bb1e70f7c51c73b1ec6d30a02dce0ac9e732cb5ef81109ba079a06e9
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ktab.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
        • Size 31.8MB
        • SHA256 df1dc05e9c64b5b08cd405774691026e543e815a75e75e790ce2f84de0711ae4
        • MD5 SHA1 SHA512 SSDEEP TLSH

        native2ascii.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
        • Size 31.8MB
        • SHA256 ebc260d3ea1ef4bb704d8f98ebd0fabbc4ca876e8bebe0c7a276f90ad62b65bd
        • MD5 SHA1 SHA512 SSDEEP TLSH

        orbd.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
        • Size 31.8MB
        • SHA256 7c57916f32c7dd9187ee3b7f5ac2ed758a4030fb03e4aa99a52ed07e33fd6428
        • MD5 SHA1 SHA512 SSDEEP TLSH

        pack200.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
        • Size 31.8MB
        • SHA256 153c3be67338902f5f0c45d9ab186aa38f6fb989dc61bd425f71507bfc1dea44
        • MD5 SHA1 SHA512 SSDEEP TLSH

        policytool.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
        • Size 128KB
        • SHA256 43487443e34438846ba103b7924eff4a32e10c362356ffe679e3f7f007a74316
        • MD5 SHA1 SHA512 SSDEEP TLSH

        rmic.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
        • Size 31.8MB
        • SHA256 1d039af683444de1a885839e5c03402bd8747a25305e45253640a82857b542ac
        • MD5 SHA1 SHA512 SSDEEP TLSH

        rmid.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
        • Size 31.8MB
        • SHA256 89a1c0e81eaf90b279f018c9c21902fd99995a9ceb87c54378556b39ba31380d
        • MD5 SHA1 SHA512 SSDEEP TLSH

        rmiregistry.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
        • Size 31.8MB
        • SHA256 a1e110039fa4fb14af64eeb6af5d44516c954e9d7d43663d3d7565c2f835b63e
        • MD5 SHA1 SHA512 SSDEEP TLSH

        schemagen.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
        • Size 31.8MB
        • SHA256 c398e4423c305e2ca28723929d9f8dfb680432e43f9c07802bdf1ceaa08fd847
        • MD5 SHA1 SHA512 SSDEEP TLSH

        serialver.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
        • Size 31.8MB
        • SHA256 bfbb8ea911d1b59821df9d3d11d3fba442968009656abf7a10f9d13995aef861
        • MD5 SHA1 SHA512 SSDEEP TLSH

        dotnet.exe

        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 31.9MB
        • SHA256 d8ce9353a14d8e9f837a6fd505ab7eaf8bec002d4bf20fc4fb904d4bc990722a
        • MD5 SHA1 SHA512 SSDEEP TLSH

        createdump.exe

        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 31.8MB
        • SHA256 1053682b3422b34779945637c53e19ee7f6e2cfba9ddf7ad14146c7e5f990638
        • MD5 SHA1 SHA512 SSDEEP TLSH

        createdump.exe

        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 31.8MB
        • SHA256 0aae6e2ad44701af69160ff134e4fffa7e80fa5f8c15aa1fc4b5378a7c6915d3
        • MD5 SHA1 SHA512 SSDEEP TLSH

        createdump.exe

        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 31.8MB
        • SHA256 49e00323fc2c2d6306b51b2b847a14e5b0762ff38df4b004bf7fe77503c8be55
        • MD5 SHA1 SHA512 SSDEEP TLSH