Overview

overview

8

Static

static

3

2026-07-05...ar.exe

windows10-2004-x64

8

2026-07-05...ar.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    149s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260629-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    05/07/2026, 03:52

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-07-05_34841b587bad59ed249ed52b8cb19f60_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_remcos_vidar.exe
  • Size 11.6MB
  • Sample260705-efe5yacz4k
  • SHA256 7b23641ac8f25efa60b8722b81ff9c5c883e925d8cba2f4d1b52ecaf524f12c7
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
defense_evasiondiscoverypersistenceransomware

Malware Config

Signatures

  • Drops file in Drivers directory 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Sets desktop wallpaper using registry 2 TTPs 2 IoCs
    ransomware
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies Control Panel 4 IoCs
    defense_evasion
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-07-05_34841b587bad59ed249ed52b8cb19f60_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_remcos_vidar.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-07-05_34841b587bad59ed249ed52b8cb19f60_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_remcos_vidar.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:504
  • C:\Users\Admin\AppData\Local\Temp\2026-07-05_34841b587bad59ed249ed52b8cb19f60_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_remcos_vidar.exe
    C:\Users\Admin\AppData\Local\Temp/2026-07-05_34841b587bad59ed249ed52b8cb19f60_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_remcos_vidar.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:3320

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        Uninstall.exe
        • Path C:\Program Files\7-Zip\Uninstall.exe
        • Size 11.6MB
        • SHA256 395600ab43aeeb0dc740d28eb8fe58eb8a9f941c99d48b5a6a12a60760584215
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        AppVShNotify.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
        • Size 23.4MB
        • SHA256 17a7cbfca761ca255a4a239b5e8506b8a9ae318c9247252ca42b63861a946663
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        InspectorOfficeGadget.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
        • Size 23.2MB
        • SHA256 0a407d33866821ac413b301a5d4f915a4df2491495395cd548b17eeacfc5511d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MavInject32.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
        • Size 11.6MB
        • SHA256 7b23641ac8f25efa60b8722b81ff9c5c883e925d8cba2f4d1b52ecaf524f12c7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        OfficeC2RClient.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
        • Size 46.6MB
        • SHA256 ade35f2d2d7bad5549ea128ab5d7c64b156157727b9461f34dbec4047a5cc843
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appvcleaner.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
        • Size 13.7MB
        • SHA256 d0401100d8b79f33563ab827ef5da7884ad7555a94b36ba700b79cccb9cbd3a7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrmstp.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        • Size 29.2MB
        • SHA256 dd6cfda0d68de1b5136d0b84729c461b6d14832f86bf2494ebc4b985c5855cd2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_pwa_launcher.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 24.9MB
        • SHA256 b7a03de1fa81fce615442cc685805effdc433308ef7cf7718f020de1a61cfa5f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevated_tracing_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 26.6MB
        • SHA256 4c7b71fa8120539918be8b0670b80d47cfdc60ddd9eecba1660c3c4a73f821ce
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 25.4MB
        • SHA256 3eec7a433dd8b44ea31021860259fca6123faf829cda6e4412d79cae516c9759
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notification_helper.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 24.8MB
        • SHA256 fa7cca37194459c8127a7d672aca9c1ead82daefcc9af61ae9cfed66fb635a17
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        os_update_handler.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 25.0MB
        • SHA256 9911aed5236e4b2770f8a8f52406ce55b06826f4b8dea55a629fb59bbc1a1acc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_proxy.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 24.6MB
        • SHA256 a9852d617d1928c00c8f5399e403fdaefbee9ecb365313a26bf61d0585f82d8d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 23.2MB
        • SHA256 816f31741259687259679e7f76e2a1336992e97e8603c0c415184af0aa70500c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 23.2MB
        • SHA256 bb0f00d46c2ec5de42633a23e3f78344f0500e99fde1a7f3a57224be8ba17cd6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 23.2MB
        • SHA256 0380c3d6a4bd96d0d7aadd204e73b26fa0a746659d33c9aaa8023f1192d56131
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 23.2MB
        • SHA256 1a6ca8aef0b383117606916b877c8126bf6a9a74428944cb612169814a32b6b1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jar.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 23.2MB
        • SHA256 f0088701f372bdcd6e4c2c50c6f0918818cc38badf739325dff09a71fe4b3e3c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jarsigner.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        • Size 23.2MB
        • SHA256 89ce2cbbad54292d322a27ad9cacc94920cc6cedb8985a7f7bab78549f91f3f4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 23.2MB
        • SHA256 cbd90503a53c348269abc3ed503249c066b7d1ce8b31141c74d5d4c81670ab69
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
        • Size 23.4MB
        • SHA256 d1089f8acebfa63b09f397556e3469402e2a451b89451d953edd4ff681292650
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javac.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
        • Size 23.2MB
        • SHA256 d1c57b6e0554bce7b95052d73e04c91f1cdd2f282571fc4ff9e0d8e378b5d1bf
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javadoc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
        • Size 23.2MB
        • SHA256 274add43804e51847478786d36cc6a565333a90f569817aa6fa21944b2dfc691
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javafxpackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
        • Size 23.3MB
        • SHA256 1444619c2542ff0a5cd4dbd5ad8c5bb43e6f45e223068ee33713abaf1a9def21
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javah.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
        • Size 23.2MB
        • SHA256 33c8ae21ed4bb81aae29577ba96518fe60837509c19e1d45bf74c7918c42c489
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
        • Size 23.2MB
        • SHA256 93970d5380eaf3bc1a1b717d55a9b02eaabbb92b2b2356a215246d536683aea5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javapackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
        • Size 23.3MB
        • SHA256 5d83d285e4652362ae01d0b9ac96063c6f7303fda333e182f650973d92cdb420
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaw.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
        • Size 23.4MB
        • SHA256 b0880c56bf566539f01db017c1dc0358495ef364928d996c4a9aa9a0ae06f783
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
        • Size 23.6MB
        • SHA256 b25041c2b47b0e3483f431902dd4867f53489e38175abf1b7546dd1d658afca5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jcmd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
        • Size 23.2MB
        • SHA256 2318eeceb2b15b2b4ba9c73040054787da0aadc0ec2302d18589ac91d608acef
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jconsole.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
        • Size 23.2MB
        • SHA256 6ec1781ede504767fe222530674bfeb8f74e92220a7b8ca51f457ff6f30acdbf
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdb.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
        • Size 23.2MB
        • SHA256 07a2894e8cf4ea9bde171b5698535ffdcf890753e655ff26cf2d88e381f6b94e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdeps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
        • Size 23.2MB
        • SHA256 043d299ab17c45be161da9fd2c659eb2e5d0565a3ccdb7d8b327a5c9489f10ec
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jhat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
        • Size 23.2MB
        • SHA256 84ff0d9c203f75fed77bab6048e67936522db564e9b2dd8fec3fd0608dedb9ff
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jinfo.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
        • Size 23.2MB
        • SHA256 ee4f31444f764c9040b4fc459696867aad407014b79bec95c5623d55b8d7f0e1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jjs.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
        • Size 23.2MB
        • SHA256 2a161ae55cb1a055a7241854b75346a8e024f304ce1adda6ed5533fa567f04fb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jmap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
        • Size 23.2MB
        • SHA256 f47b045c28c2a923fd88e270b043f48daa58fa1f721bae89a834ff18b4f71edb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
        • Size 23.2MB
        • SHA256 0984b5784c838ec0bedc331c9d112579ace4702eedd6cd6dac24e8230db7f0dd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jrunscript.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
        • Size 23.2MB
        • SHA256 200eafb309b6c1155f48dd79dabdea59c8fbe050c931e4b342d4e4921ff962d2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jsadebugd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
        • Size 23.2MB
        • SHA256 d9ea4d0f21544888f7f3a43b63e0e8c7ce2b21b614ad7ecdd4b18529587afcca
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstack.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
        • Size 23.2MB
        • SHA256 61af729136c312c0ff09d09dcd75a74878e650bb01f13fa1d2c9f5bb620a70a9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
        • Size 23.2MB
        • SHA256 d229b743af54a78d7132bad1fa2cf25f4d1616c11e18819fba3e21687dd39736
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstatd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
        • Size 23.2MB
        • SHA256 a83edcd549a9797a8fd97c645d0cee576babb5ef6268d5f40d450c88897c1c26
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        keytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
        • Size 23.2MB
        • SHA256 4d490664f169904633598f780d7c96807e67a911f1092e14990b8c17f0115e7a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        kinit.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
        • Size 23.2MB
        • SHA256 fb688a0fb8d0069b6ccc88bcfc1f006b00540219281f55b40b2c7d2341e4d362
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        klist.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
        • Size 23.2MB
        • SHA256 081684bf97b6dc0c533dab19edfa3495cfa7a37de5cd83683939beef2d130439
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ktab.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
        • Size 23.2MB
        • SHA256 0c91cd84d99239d6dc1d60ffbc1d44e791f18750e1f51ec6b174b98df9dfb8c4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        native2ascii.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
        • Size 23.2MB
        • SHA256 2fe0c8b4122f865cfb66d17f4e9363c370c3b4276ffd8e389f7178600d030d07
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        orbd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
        • Size 23.2MB
        • SHA256 47042b0b77b6ae7c1c4412ffe06f7f7539f01628ca74e045b9cf76e3d487d65e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
        • Size 23.2MB
        • SHA256 c779c9b8012d0f7c5083e17b1d76dd117326f86ddebf2d1615c6f946b47aa3ab
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        policytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
        • Size 23.2MB
        • SHA256 b4187648362ff325e66c51fc8c6a268fcaa4d4d2b8be70c45647d6cff69cdf33
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmic.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
        • Size 23.2MB
        • SHA256 1697d068921ff9a187929b276f7da5699faae487cd83443d7e1d64fc97db5025
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmid.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
        • Size 23.2MB
        • SHA256 033baaa74f3ea8d728b7675c316dfbbf2a0ce5da67633b89a165c0aec1227d06
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmiregistry.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
        • Size 23.2MB
        • SHA256 f8e9bfc9960cfe6175fe83ebacd595c52a79dcde97c0135923931cbd97fc27aa
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        schemagen.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
        • Size 23.2MB
        • SHA256 096da9f835d919af6a68fc02cac15f8ef79d4cbc6300945bc04975da5151f82a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        serialver.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
        • Size 23.2MB
        • SHA256 3de7a39b4f897c13a669d6b6f1bade90bbbf40ca44778528eb65fec553c25a1b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        servertool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
        • Size 23.2MB
        • SHA256 cd36ca209027ee34685bf1cc304233694fbcc082ca78c09aaaf531524e6170ce
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dotnet.exe
        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 23.3MB
        • SHA256 8c9f23a31fc0e8dd25887a4ea3a052cd147c2ceb570c33c59f68a995b6c8da48
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 23.2MB
        • SHA256 de66188b56af8624910e884024365da7d95b34b814383f7cd12feefa71363aa6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 23.2MB
        • SHA256 51ccc5f06b7248aa9068275af6ceb00635b91c11d315ebfcd04c6fa454f674d9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 23.2MB
        • SHA256 74ec7724feb038ee1b9dc513b3fa36728c12e673dcb684280c6b9204d18ae7fe
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download