Overview

overview

8

Static

static

3

2026-07-05...ar.exe

windows10-2004-x64

8

2026-07-05...ar.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    149s
  • max time network
    134s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260629-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    05/07/2026, 03:48

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-07-05_53d5441796bcd92aa6ae470933826cb6_amadey_cobalt-strike_elex_emotet_glassworm_icedid_remcos_vidar.exe
  • Size 3.2MB
  • Sample260705-ec33laht3s
  • SHA256 cdfc62d2b5d19b187ee968e02a393302833b1293b424b1f5bd4ee650de7c89f1
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
defense_evasiondiscoverypersistenceransomware

Malware Config

Signatures

  • Drops file in Drivers directory 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Sets desktop wallpaper using registry 2 TTPs 2 IoCs
    ransomware
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies Control Panel 4 IoCs
    defense_evasion
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-07-05_53d5441796bcd92aa6ae470933826cb6_amadey_cobalt-strike_elex_emotet_glassworm_icedid_remcos_vidar.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-07-05_53d5441796bcd92aa6ae470933826cb6_amadey_cobalt-strike_elex_emotet_glassworm_icedid_remcos_vidar.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:4340
  • C:\Users\Admin\AppData\Local\Temp\2026-07-05_53d5441796bcd92aa6ae470933826cb6_amadey_cobalt-strike_elex_emotet_glassworm_icedid_remcos_vidar.exe
    C:\Users\Admin\AppData\Local\Temp/2026-07-05_53d5441796bcd92aa6ae470933826cb6_amadey_cobalt-strike_elex_emotet_glassworm_icedid_remcos_vidar.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:5756

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        7z.exe
        • Path C:\Program Files\7-Zip\7z.exe
        • Size 3.7MB
        • SHA256 31370615a13112cdc1a37666b0e5e4c0e506cf353a4625930e92e8a7ffed2098
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        7zFM.exe
        • Path C:\Program Files\7-Zip\7zFM.exe
        • Size 4.1MB
        • SHA256 8c223f603434ffd4a058aee7405285e93714a992fc6b776d3af860a953598349
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        7zG.exe
        • Path C:\Program Files\7-Zip\7zG.exe
        • Size 3.8MB
        • SHA256 d166fa3214c3d4de9dc290f679534723ded8f7bccfe35ed9d2f23e9610423690
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Uninstall.exe
        • Path C:\Program Files\7-Zip\Uninstall.exe
        • Size 6.4MB
        • SHA256 c3893715b46cca926249412c4e4684cc444a43686bcfc238935ea5dad77d22de
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        AppVShNotify.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
        • Size 6.6MB
        • SHA256 26f5c0d0e13be08b93c9a73c64c5c629e3c212df5d83b44fcb34100a5e7b6462
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        InspectorOfficeGadget.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
        • Size 6.4MB
        • SHA256 d2a743483b9b29a3bae5359c7602246ba5384df393bf778a7897346a5a47e82e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        IntegratedOffice.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
        • Size 10.4MB
        • SHA256 1bf379d85ced76bdea3651e7fb0c2cd86230717a908d24924a8aff4ea964e146
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MavInject32.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
        • Size 6.7MB
        • SHA256 5827e3465daca6a170fc21d5d27b85e9f73a336f0c05d366d10880f1f4b90f51
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        OfficeC2RClient.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
        • Size 29.8MB
        • SHA256 850effc7bcadb286b247c8cbb774b7e6fcf946598738b62a2bc8941baa0769cf
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appvcleaner.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
        • Size 8.5MB
        • SHA256 f1c2898a4c4fbb30accd5d1d761891d938e9fcaad52773da9992be1f54f09af0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        setup.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
        • Size 12.4MB
        • SHA256 70ef7240822506da4e8d1a661b3f9a5e43855869e96d0ca86c0fd38a411525f6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_pwa_launcher.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 4.9MB
        • SHA256 0fab166b7034dab65451ea9bbf8b66bcd5f38a2da4fb620b2f278bd3468b4164
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevated_tracing_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 9.8MB
        • SHA256 eeb39abb56dd3ae3fb5ba15b6dfd33a45cb48bd67ebf1e1e6dae5d80e6b9cf22
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 8.6MB
        • SHA256 bb88096ae8bf2ef3a7f796fafdb4405702aa1e41b37f6005905a80230de751e1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notification_helper.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 8.0MB
        • SHA256 350fc504e6d0608f2fdc055898a6a5358f285d82aec94b78a879fc09fbaaebb8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        os_update_handler.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 8.2MB
        • SHA256 e4772a6750b01748dd03fe2c6aeb33edeee26b2e526711a3398af201ee3d704c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 9.4MB
        • SHA256 c669b2e3dd5f1fc5e70f8ac136f57a9e9cbcb8e1e9a4f9366f4f18cc13b4c326
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_proxy.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 7.8MB
        • SHA256 51dc99cb93e18e0d44c779cd0585b5d6ccbff43ec7e993872701bd984208a574
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 6.4MB
        • SHA256 501b6c99bd98064976eb227429977535e9b9921165528c9dbd439cc91475141b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 6.4MB
        • SHA256 dcd909098e0dd9f41d0857b62ba31309861a149d861ed7c7ce2243c8f451d9a3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 3.2MB
        • SHA256 ee631b3a5d6ba14f0d7b099fefb0f723746565bfbd2457bbf725d9c664b9e404
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jar.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 6.4MB
        • SHA256 aa7fbf29038d16dddea6ce9a2e665333a250aa4b47cfb17a546c9864060711f1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jarsigner.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        • Size 6.4MB
        • SHA256 93217a223be8b092e0817e558437486e03d4c2703e71ac77773394be26beb6a9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 6.4MB
        • SHA256 ae79c25329550a18bbec4cf28d5f6b8e5d645416104fa5e67a46ea602ce7ad1c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
        • Size 6.6MB
        • SHA256 a7a4b2b3b2d153dd43553df309ddc87db8b33f2e505e592d5bd6c126c381ad6f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javac.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
        • Size 6.4MB
        • SHA256 8f586dceb652b2da7c1c7d95847eac218c830df519a018ca20d7baffe0d0ab2c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javadoc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
        • Size 6.4MB
        • SHA256 d432b7e51e82b5896beaae7a2177bbaf4770078c75d08a3cbe4eb08d15614323
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javafxpackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
        • Size 6.5MB
        • SHA256 273d24e702dafe1f604af7e2f85b620bc19e12c0496861b44023b28e7db01c5e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javah.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
        • Size 6.4MB
        • SHA256 bb4ca780c8293f63d64e6ee19b0cc0a683d9faa02ef3ba6bc975b293c2efd458
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
        • Size 6.4MB
        • SHA256 51c930690196417817b2a0c3c653fbc21719fb49d29fb64d997e0a91c5ebc718
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javapackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
        • Size 6.5MB
        • SHA256 71f59a1c04f3130f490d4c632cd9d1eebd0cd334d4b140d548166ab497ad1deb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaw.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
        • Size 6.6MB
        • SHA256 bd9c134bbfa1275cbfd3ded1f8989e2847cae8387115b3944e135f3625a4c1b6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
        • Size 6.8MB
        • SHA256 d3e339557f716ea98a242f7ec71fcc8793f67eff76386d7e91f5648b0401fa2b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jcmd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
        • Size 6.4MB
        • SHA256 492627b6ef36b076411a740ad7fe7a334881b157084f522782d4ca4859134503
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jconsole.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
        • Size 6.4MB
        • SHA256 26727987f720833b1901b125dd1655c5aa02cab1344585324119a64d6419b91d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdb.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
        • Size 6.4MB
        • SHA256 63a988ad1bea40e7123f6d86bf50181c13749816d5356e7affeb408e5f50a5ec
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdeps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
        • Size 6.4MB
        • SHA256 4666ce1de39117a2327a35121809a30648c42679daf268a6c9c5150652276bd8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jhat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
        • Size 6.4MB
        • SHA256 3d1e4de3e7c8af627a9f0abe587935329678ee8bbf37f8be55c82c44f4209f19
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jinfo.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
        • Size 6.4MB
        • SHA256 aa353426c44b9cedd6c15678d9433b2feea6f92c0d035d0018a08a20a1fb2f5b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jjs.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
        • Size 6.4MB
        • SHA256 82514992f4310537c546886942640d70f129305c7074fbfaf6feeb9cae7818da
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jmap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
        • Size 6.4MB
        • SHA256 10ab9d8e45c4a48d4d136c0cff871e43aa7feb8d1fb8f3b5aeb7e07b563267ef
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
        • Size 6.4MB
        • SHA256 e678545b73b909ebf79834882f90386e3ffeff0641fe75f9c54736e3be68ec97
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jrunscript.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
        • Size 6.4MB
        • SHA256 035d2239d7657e33785ce7e64e66b0f7f18af69abb1dc47ac5cb68278bfdcf9f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jsadebugd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
        • Size 6.4MB
        • SHA256 9a38835211206f4be4d971462c0c27ee6f952482c49f1072b9dacc2c941a6ec3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstack.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
        • Size 6.4MB
        • SHA256 1c94df9985dc7f6db8285ad6d86d99bc80284c0b009fa804bcaf7ce8c4ed444b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
        • Size 6.4MB
        • SHA256 836d991e4bf2e79a84bac5094a5202b51d9b022d25a10d97db02f43b7a800372
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstatd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
        • Size 6.4MB
        • SHA256 5155b8edbd99e37a8db469ebeda6f165bbff0be6717e6e9ad6852f352a7f0eb0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        keytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
        • Size 6.4MB
        • SHA256 0007811ce8e5fa87d0d975fdf7e4da4704b5ba9ed1ff7fa0262a8576125d402b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        kinit.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
        • Size 6.4MB
        • SHA256 a92659b14c6dec0bcaef1a93fcd3915f6e93f760ef7d8efc8a1ea870014e1956
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        klist.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
        • Size 6.4MB
        • SHA256 d7725f6a7f11c10fb7379ed652c3db8102e79376bebf4e8ebc50f78f62a3a874
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ktab.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
        • Size 6.4MB
        • SHA256 abcb439e4bc832caced707b3687ce3ab4378b4c482f9c9545cd8d9bba8413767
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        native2ascii.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
        • Size 6.4MB
        • SHA256 6bc20657bb471b223d5740e5321383f519c44bdee9369275ce3a1c24d08a9232
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        orbd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
        • Size 6.4MB
        • SHA256 6434175d46cac826f021b05e1fcd8aa4ae3502f2a7e20543e92710cb2cf593d0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
        • Size 6.4MB
        • SHA256 c3364059f1a98fc1e6eb83e6af71f743a81a0156c8e50a6bc8074e880d301506
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        policytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
        • Size 6.4MB
        • SHA256 2638a699be27482da150031a5554c6ebb3e5afd70054b1abbb8f8f17ca768a27
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmic.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
        • Size 6.4MB
        • SHA256 c969337cfc03e9bfc742f974e5a686b3c498d4ffc773ac5c39eeb77e0ccbdb4d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmid.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
        • Size 6.4MB
        • SHA256 f5d90ce12eb626c838ba54f9c3eff6bb6ea1bc1666f6417b4a4eaa1a8638f477
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmiregistry.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
        • Size 6.4MB
        • SHA256 bc7eb7be609d2c498d54918deaf89cc85184218942579f2e59b7402725402330
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dotnet.exe
        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 6.5MB
        • SHA256 ac6f4dd9a4b7776a907c7a01fa4b35c7f1b2467baaaec48c434f678bd996981c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 6.4MB
        • SHA256 300e6755b1d6a9864ee3a5417795d4066f9b63754c633a58e3b0d01724c40878
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 6.4MB
        • SHA256 010861a7d7f34804c8a7b7f7a34f2e3607ad2723a85b313d395af66cf049bbc2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 6.4MB
        • SHA256 331aafbd0bb80a85a4f304f6b8b3bd7fffca346a0d22c1c241fd5ff2152b01a3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download