Overview

overview

8

Static

static

3

2026-07-08...ar.exe

windows10-2004-x64

8

2026-07-08...ar.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    38s
  • max time network
    145s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260706-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260706-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    08/07/2026, 15:16

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-07-08_28e2f68249b2f172b638c93cd382cda9_amadey_elex_emotet_glassworm_icedid_njrat_remcos_vidar.exe
  • Size 34.4MB
  • Sample260708-snwdsahs4y
  • SHA256 25b6f5248ad90409026a0155395806ad5565afa3efb269623a330fbc6e49cbe8
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
discoverypersistence

Malware Config

Signatures

  • Drops file in Drivers directory 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-07-08_28e2f68249b2f172b638c93cd382cda9_amadey_elex_emotet_glassworm_icedid_njrat_remcos_vidar.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-07-08_28e2f68249b2f172b638c93cd382cda9_amadey_elex_emotet_glassworm_icedid_njrat_remcos_vidar.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:5876
  • C:\Users\Admin\AppData\Local\Temp\2026-07-08_28e2f68249b2f172b638c93cd382cda9_amadey_elex_emotet_glassworm_icedid_njrat_remcos_vidar.exe
    C:\Users\Admin\AppData\Local\Temp/2026-07-08_28e2f68249b2f172b638c93cd382cda9_amadey_elex_emotet_glassworm_icedid_njrat_remcos_vidar.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:5468

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        AppVShNotify.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
        • Size 34.4MB
        • SHA256 25b6f5248ad90409026a0155395806ad5565afa3efb269623a330fbc6e49cbe8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        InspectorOfficeGadget.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
        • Size 68.9MB
        • SHA256 e45c7175bb77eb2409c3ee1956e45392e03e057d652fbe59a2c432a4edf22dd7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        IntegratedOffice.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
        • Size 73.0MB
        • SHA256 0c0850a5ad9c1b76f2c113c2eb8fd30300a4b0275e26227432973d9811aa9aa3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MavInject32.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
        • Size 69.2MB
        • SHA256 e3922448f45231f520a0956795b1c5e383886f81c34fe1474c19e4df894ca92a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appvcleaner.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
        • Size 36.6MB
        • SHA256 bedabd5c03c6a98304de5e0907691afc46c5d701dabe38e3c9f8830671b6b6e8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VSTOInstaller.exe
        • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
        • Size 69.0MB
        • SHA256 ef48c63eecddcd3a382d4726d0beb17989cb146a0ebd3309e8df326b5f8700af
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrmstp.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        • Size 58.1MB
        • SHA256 463860fb96488f9fbbe088e3fe8bfb0e5fc8708e30d8b6ef9e327ac3c1a86881
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        setup.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
        • Size 56.5MB
        • SHA256 df898420c8e3c1b6f90b88d062d7dd9dc3fd2ae3d1cbbe0e2aefd573597021b4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_pwa_launcher.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 62.4MB
        • SHA256 93519a67726b94f826dcb1dafc731436c306b9db8525b716926ba86caa8f295f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevated_tracing_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 60.4MB
        • SHA256 72052d4faac728ace70f3edd935e956413b5cf9e02fdac62d3897b3366cb4f68
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 59.6MB
        • SHA256 2a211cb233d9cc214beb9d614d98f122ebe4d297baaebb4be5dab6cc0a33a1e1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_proxy.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 54.9MB
        • SHA256 4ffc1c49b04e5afe8572d38750ea3b75196cd85f7d0d68c10a2a63d36efd1a6b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 51.8MB
        • SHA256 d13459adeb5f682b7c71356798fb8974f516da104aa54996584d4fdabafc5415
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 51.9MB
        • SHA256 1263f554b878e962d1f417072e071aa8eaf6f26430850b9c4bc4b24068dbb037
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 50.2MB
        • SHA256 65164f05c38675c38963698b4ddd7e51698eacf72ff0428798ec07ab508ead39
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 50.6MB
        • SHA256 47556b5f9d67113d96a6a13aaf6be12497125489ac010a6449e265414405890f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jar.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 51.2MB
        • SHA256 fd95ff68a4ab0f09d656facfb7942b92f7552c41c83722ace5062c9d359c5e5e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jarsigner.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        • Size 48.8MB
        • SHA256 bcbeeb01775670856e9e43c1ea7a1ed9c81b14b8928280e552adc268dcbd5c14
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 49.9MB
        • SHA256 5e1ae51f700f90592c049ed5ff38338902068782cb35ac3dce9030d8952a68a3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
        • Size 48.6MB
        • SHA256 899f8e0921547a6998dc920cc9ed3018c4899561ca203f9561d028e6d6be2a92
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javac.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
        • Size 48.1MB
        • SHA256 eb8ea09229071375c37a426324d83da6eefb87f0f40d71ac6c9615c4816d7b87
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javadoc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
        • Size 47.1MB
        • SHA256 f3b6c4c952217f75ef80f296127e709a379aab3969eaac3859fe9a1a25c1a699
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javapackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
        • Size 46.2MB
        • SHA256 906557aa379f15e3c02be232fbdc5d0907cb3b594548dcaaeb938c023489b8ce
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jconsole.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
        • Size 43.7MB
        • SHA256 22ada43f4417d56907f3bbf5742bfed6cc1ecb88bc076024be99a0dda5d1d687
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdb.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
        • Size 42.4MB
        • SHA256 0134d49a30b9307aba2422d1188d3cca836bed6efcb7b289dc2268ca78fb3cd9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdeps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
        • Size 40.0MB
        • SHA256 62aa4ba00cf4537507e9794f6253ac9c77be11a4da5a983059c2fb122dad21b6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jhat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
        • Size 39.1MB
        • SHA256 c254204acb07f26f6b8f800054a26126b0ec75a94a717537fe6fd7aff0ec4ffc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jinfo.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
        • Size 38.4MB
        • SHA256 6d613d7c4963e6dad530ffe6dd2b6dc4fb7858b59075456b8c24715f9ec34c9c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jjs.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
        • Size 37.4MB
        • SHA256 05e297a1d5fc67d42527aa571c884b3ad3fe42f3d952defe8a9330b207a284e1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jmap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
        • Size 36.3MB
        • SHA256 e883c9fe11fef3b4bd185244c77ca55d47c4b8d535b5d1ba73fdbcc967afde61
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
        • Size 35.5MB
        • SHA256 271cb5b5d9c319149b48168b0dffad6152369e4c1892a75db7d76734668c0387
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jrunscript.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
        • Size 35.2MB
        • SHA256 8a94188dc3b918bc9090b8be0ca8caed42e8ef906051353d49fde106df71a5e1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jsadebugd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
        • Size 34.9MB
        • SHA256 b79d4294ea5b6b3c0cb57710504d91ef7aa67445aa7f13c0ee47cddc38a3b6a0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        kinit.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
        • Size 33.8MB
        • SHA256 05c677f7836f9718c7e97713a7048f5551c6aa7e552db43c6a07a8911dd98f64
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ktab.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
        • Size 33.2MB
        • SHA256 d635fac4db204d5a9a384c6adce138baacb10edcd77d8939babaa3d436276964
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dotnet.exe
        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 67.7MB
        • SHA256 1c0261f331c2bf88882631e555ad861f647ced5e3567cbb68ed7b264acd77f00
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 65.8MB
        • SHA256 d14a06a13cce4b02cfc04890ccae9985f554872ef17d3d80b6e807ca96dc302e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 64.5MB
        • SHA256 cd19ab0d59b8e65c77ae09560c5cb61303128569c133fb4484f93a152fec6734
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 63.9MB
        • SHA256 ccf6659bd19820a1b9882a0f1e24c31c03766d386b823e666bf7f4af63891a61
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download