Overview

overview

8

Static

static

3

2026-07-06...ar.exe

windows10-2004-x64

8

2026-07-06...ar.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    22s
  • max time network
    124s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260706-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260706-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    07/07/2026, 02:11

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-07-06_952a4010dfb5dbe099efcce323fbe7db_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
  • Size 20.7MB
  • Sample260707-cmaspacy9l
  • SHA256 cc4dddc7e4bf19c31b9088e798d4d0fc68fe107ff48a325ad2e331bd298aad86
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
discoverypersistence

Malware Config

Signatures

  • Drops file in Drivers directory 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-07-06_952a4010dfb5dbe099efcce323fbe7db_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-07-06_952a4010dfb5dbe099efcce323fbe7db_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:2724
  • C:\Users\Admin\AppData\Local\Temp\2026-07-06_952a4010dfb5dbe099efcce323fbe7db_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
    C:\Users\Admin\AppData\Local\Temp/2026-07-06_952a4010dfb5dbe099efcce323fbe7db_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:5772

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        7zG.exe
        • Path C:\Program Files\7-Zip\7zG.exe
        • Size 21.3MB
        • SHA256 c7cc6ae74271942842ef67684ab15949d680527b68b8d40d0919d7474888c4c5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        AppVShNotify.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
        • Size 20.7MB
        • SHA256 cc4dddc7e4bf19c31b9088e798d4d0fc68fe107ff48a325ad2e331bd298aad86
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        InspectorOfficeGadget.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
        • Size 20.7MB
        • SHA256 8e4ebb578cedf42c6a35bfeb756fc0b2fd5f5487530beb868d57d0b3b859c0b0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        IntegratedOffice.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
        • Size 45.4MB
        • SHA256 f3a307032c46a5fc1517df98e449d23b6ffdd1e4e8f18a558861541187b24692
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MavInject32.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
        • Size 41.7MB
        • SHA256 bed75196a46321d7528d85e35e39492a2604a89b11f550af60d9b61751294cba
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        OfficeC2RClient.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
        • Size 50.1MB
        • SHA256 746b872b16c5dd6d92a56bf9d3b018ff7312829fdf5e7ca560db068b10835b5a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appvcleaner.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
        • Size 22.8MB
        • SHA256 2cd1313732d7cf805b292a1953b973acfc8b4bd7ed5f9365433a96caf8b7c227
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VSTOInstaller.exe
        • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
        • Size 41.4MB
        • SHA256 e210804062acd363fa65431bcd985ac175fa9b2442412e8ae8cbeba2b796e3e2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        setup.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
        • Size 47.4MB
        • SHA256 ae6df5fbefdba429b121d3d2f2edc387a4fd4d8a288e075454374977536eeecf
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notification_helper.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 43.0MB
        • SHA256 107c403e12ff08046893b9dff6be83bb9a687de1d2118dfb777a329ea0034be0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        os_update_handler.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 43.2MB
        • SHA256 99b1c1982dc4c34dc733a62d287f0a1dd91c64894dad6501a92fa4319837a428
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 44.4MB
        • SHA256 9add8dd0d14c729cc537b109795beff66095d323d4d6539ec9897604f1ef8ad3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_proxy.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 42.8MB
        • SHA256 789864564b2186a0461af796eda7f57cfce9af88cc01699eb0e00f507c5f7421
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 41.4MB
        • SHA256 534bae082a23baa0872d24fdaf7ac1d6b66a717e812a472685fbff74486f8020
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 41.4MB
        • SHA256 7e2d59ace34b9bb9f5d79f82d9c42c3df2bdaf2c535d3c7e7879e156fe0023d9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 41.4MB
        • SHA256 56bdc50c2a1a21cda07ffb3f470423ff5b8cc25709c5ce7cf07dd9c941a2c47f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 39.9MB
        • SHA256 3205d941b1703ed97049e577e4929b5211d75250405046e9a707473e56839d8c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jarsigner.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        • Size 41.4MB
        • SHA256 4cc3a6ef8bada4de8939180ef05dddc9cc5e9410f7635394428cc1ebd6cc97d4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 41.4MB
        • SHA256 89fa4b6243e6df9b6e0df24f092573da0faa725936c261d0001a583088edb190
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
        • Size 37.9MB
        • SHA256 d9a2a6c9c9d52416cb038ddc3eff5f38a745b742fbfa2e2ba63d4c0551809d39
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javac.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
        • Size 36.9MB
        • SHA256 2761d70cbae8cdd6a4c2b4418de921ee79686d1ed9d7640c7c09cfa5c9753e49
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javadoc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
        • Size 35.8MB
        • SHA256 93c393719b2a5dc22b7da7ce421461d5a6d1b2eb8a7f54d8ef567aa6eb4ebed5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javafxpackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
        • Size 35.5MB
        • SHA256 dc5a1422064e307032924399f75c865342ed1e4749fccc9f07a0d3e298e0700d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javah.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
        • Size 38.8MB
        • SHA256 e46d095ee0901e4bbb702868efb79ca26862a295ee22f53c8d1ca4405259f221
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javapackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
        • Size 38.3MB
        • SHA256 5c92f98ad0529ea2e9770d0dd870a2218302fe35685559b0f27d6ec0c36f4ea8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
        • Size 34.4MB
        • SHA256 a28fc7baecee9a57d03d8b8d6b3862ab5ccc6b3c6ac49eb2f1ffb3b51c382536
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jcmd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
        • Size 37.7MB
        • SHA256 15a3d0c449e588cf9411ada38146d09bd68399593ef6f1870823f0608109b9e7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jconsole.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
        • Size 38.0MB
        • SHA256 3ce68dfb2d714211bb8b4832b1edf17ceadd7b92b4053b9c2723dcb3f6c957de
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdb.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
        • Size 37.5MB
        • SHA256 e3f8e1cc82f359d6cdef248d314d7d2b6063b378e716db2406175be40023a654
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdeps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
        • Size 37.3MB
        • SHA256 f77eb3b124365969a7db3b89d452ca7cf958cdfa21d14f884a999e5216ab934d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jhat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
        • Size 33.9MB
        • SHA256 8d136691f0ad7d393b66013c36113079a9a5fef6745529339d52c497d488aa4d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jinfo.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
        • Size 37.4MB
        • SHA256 21816a5efcbb498cc76be923ad393ed680bb679740d82a0c984c28e24c1807e4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jjs.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
        • Size 37.2MB
        • SHA256 6625dba17a51e9e2dce81f68f500b71b745c8f59fcdedf9bd7f2fc4f955e966b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
        • Size 36.9MB
        • SHA256 460f903d4303d167cf596d5a89a150d7aad7826f40dcdefa5ca7fa198198cbe8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jrunscript.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
        • Size 36.9MB
        • SHA256 09793ec8df277492373b37a4615d35365df3cd26bfcbeaf5d7750d66dce47f8d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jsadebugd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
        • Size 36.8MB
        • SHA256 e16b82d6e46a91627bd803933e5c5c333ce7b7c86796687a2e534d56c820cff8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
        • Size 36.8MB
        • SHA256 6a6ac4feb4aa15917cd7dbbc4efe241f847705a273a02a5b6cfe7781ec8c4c5a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstatd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
        • Size 37.1MB
        • SHA256 f0b25e239df02a9bc3ad69c2458f05a0f141f7b579bf04074c8791e6527b59d4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        keytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
        • Size 36.6MB
        • SHA256 5ec92a4562137e319c62e8af57b69934aa83dd8629baec7cf2900d6125807f14
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ktab.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
        • Size 36.5MB
        • SHA256 a83e91a8763a3710ed441118efa2af1b1f68b25e027ea44a305125865afb659a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        native2ascii.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
        • Size 36.2MB
        • SHA256 93738b850ced1da0c655ac450446c63dd8675eb8fa95d79fa7bec9ad0e01eed5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        orbd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
        • Size 36.1MB
        • SHA256 72ec3e4e89c17475258073be4796fe21184c5325c1d884b78e7cdd31b0cdd6d5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
        • Size 35.3MB
        • SHA256 61e659ff2d3d2c928f4f62eff6d8da78aadc80bd8f8ffbdb4aa20088d3661af6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        policytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
        • Size 35.1MB
        • SHA256 0a403dbea79ab823c1b0733b0d3d047714ffda34f2c72416c2fbe0f9e32b6cd6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmic.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
        • Size 34.8MB
        • SHA256 45b51864c204beb131de79743ad8793896d07d2dcfc154f2707ef2690e280f4c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmiregistry.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
        • Size 31.0MB
        • SHA256 79a66c520b89d4a6591268867fc745f71daa5829d717fa861e7b2e70119266e6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        schemagen.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
        • Size 34.5MB
        • SHA256 32b19e53caeb25ddda295f9d53d4bffe339d4fc91e7a5fd000a1e04e58a4b940
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        serialver.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
        • Size 34.2MB
        • SHA256 1d95c456908c5655735f4cab31df8f22420aa237a3318c20d74e7d550f549b4a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        servertool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
        • Size 34.4MB
        • SHA256 313ab9fe05c4cb3608381d123f0b1f4e9a8a45c896d13ec593f93ec673c57c08
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dotnet.exe
        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 41.5MB
        • SHA256 b528df9013cfbcc270bcef7de73961db38c67c9b7158bf5b4203238e92d0ba2c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 41.4MB
        • SHA256 24584fe3a5745c7dd874048101e7e1530e8ee678c538bb3fab5aeab3b32078a6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 41.4MB
        • SHA256 5f1d39c105f7da6a54382729af7d228e446826f35e485a9b74fd9a9f3812ee39
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 41.4MB
        • SHA256 b0d6c439477f68393f995b65c1c9441eb1a768309d039de7bae2efb8210b3b32
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/2724-0-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download

        memory/2724-1-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download

        memory/5772-24-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download