Overview

overview

8

Static

static

3

2026-07-08...ar.exe

windows10-2004-x64

8

2026-07-08...ar.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    117s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260513-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    08/07/2026, 17:09

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-07-08_ac62c0955a223604be150861c73c90e5_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
  • Size 37.2MB
  • Sample260708-vpgccsc16k
  • SHA256 b0b732dc0d3b759d7207123b217a3fd8d160852da7088c1b5644e27d01bc6171
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
defense_evasiondiscoverypersistenceransomware

Malware Config

Signatures

  • Drops file in Drivers directory 3 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Sets desktop wallpaper using registry 2 TTPs 1 IoCs
    ransomware
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies Control Panel 2 IoCs
    defense_evasion
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-07-08_ac62c0955a223604be150861c73c90e5_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-07-08_ac62c0955a223604be150861c73c90e5_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:4884
  • C:\Users\Admin\AppData\Local\Temp\2026-07-08_ac62c0955a223604be150861c73c90e5_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
    C:\Users\Admin\AppData\Local\Temp/2026-07-08_ac62c0955a223604be150861c73c90e5_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:2284

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        7zG.exe
        • Path C:\Program Files\7-Zip\7zG.exe
        • Size 37.9MB
        • SHA256 4c213c2a4becfed9ef3e8979505061f0f77e16cf3e78eccf0c6cbeee79d50759
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        setup.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
        • Size 73.7MB
        • SHA256 effbd0b7ba4cdc7563497b619806011ba84432fd8914b3ad5da1dbaefa90d09a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevated_tracing_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 40.6MB
        • SHA256 b4b6565dad5fea37df37eea1d6e99996fb910721cf7a85893df380880de9c3a2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notification_helper.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 61.5MB
        • SHA256 86ca4f27ada8325cbea406382f91c097f9b8a78b94072952bd81fef68dc92c24
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        os_update_handler.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 55.5MB
        • SHA256 b4f867906bd16a5001fdf5e85dd2e378f21514153ab7ce6e9474ca215d1157f5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 54.4MB
        • SHA256 30f3f117169f06ac3dd58c3ed238fb25a261688fb5469ed1aa159df7664e3c05
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_proxy.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 47.8MB
        • SHA256 c9d7e0d10ddc43002fc5c8ef69dc0b7a6f0258e89df12f4e7160544938bb2f56
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 41.4MB
        • SHA256 771210b140b6d5e08f881ecfeec3b5f406464b4dd599c39d1f06deb1c0365f49
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 41.6MB
        • SHA256 36e281d96316b05419764450b2e2a7687c09cb73ea586d84324f88a9bb7238f4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 39.5MB
        • SHA256 5fd26ec351029de6504473cf86a6dc891725e36007951e39fcdf78c0144bbbe6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jar.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 39.0MB
        • SHA256 ca33d2a3ebd822c95bec01a2e190cc68ac6590071cac68b08348a543e6e910f5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 37.0MB
        • SHA256 b10663b6e7a6199de61a1a344f4c5b58fcc6b739b2e4698ce1a90f2e7b5a0df5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
        • Size 37.7MB
        • SHA256 8253dcb10215199649d06ff48b7a3b4213da71c02502b232875a0d8351eb710f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javac.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
        • Size 36.1MB
        • SHA256 55fd907a765293d706212d75bf37dad80d47c47da1b3910285ab3a3565f4c1df
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javadoc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
        • Size 36.2MB
        • SHA256 0d08c9bb7d42c983e5b48921fa571f31a7bbc0c5d4aadf20b6e46c6f609aa269
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javafxpackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
        • Size 33.6MB
        • SHA256 0dbed0a029b0670591995deacfea1d7930c2b0eca99fba7b52fe674d1d5b4569
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javapackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
        • Size 30.9MB
        • SHA256 33cfb4079097951f1e9b49eb3e5e18d394aae756f5cb856fc9dd42abc26b1b9e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
        • Size 32.9MB
        • SHA256 91d63e8b8ab4a1dbbe146942cb7dc16186d9daac32f90981976f4ab7f9654717
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jconsole.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
        • Size 32.9MB
        • SHA256 674398c2325ae984311cb2564fb1955c1b011b3cc0a991dbe0ba92146e3d1d89
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdeps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
        • Size 31.3MB
        • SHA256 b2058c8fe35027c7bbb4c5a7d9e961c04fea99e129ba9b6a4adcc5dbe4a2418d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jhat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
        • Size 32.0MB
        • SHA256 76d31d88ba2dfc8fafc5208799983830f0a39c268cc35ca8a90456b9bf787a13
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jinfo.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
        • Size 33.5MB
        • SHA256 c1318f4ccf6648a184f6b80c3127e99fd72078d75f437d137329a322ee54b23e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jjs.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
        • Size 31.8MB
        • SHA256 6cc3d9ce034ca01b016835a88c5c1555747ff377c9dba0002c0b0d74ce9afbc7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jmap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
        • Size 31.2MB
        • SHA256 c097ac52ba1ec3307997081a361b54ef54622e9e85e3f1878c6c37bf2e41320d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
        • Size 31.8MB
        • SHA256 d2c2d0d858b3cec570a3489a11d7a9d05bf8c09a8bf87e837e58f2421d742e70
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jrunscript.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
        • Size 32.6MB
        • SHA256 3f30f88774e38f4c5d2cb8db3890647b6c343944738a61466e646e186ac94c52
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jsadebugd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
        • Size 32.6MB
        • SHA256 7bfcced74688c94d10f20a296fd347a9bf95a0151038e704afd0a6a5f304bd00
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstack.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
        • Size 30.2MB
        • SHA256 74d2c5d95c0b0cccac879d1090af5ab1c8030132623a52701db1382a9ec560dc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
        • Size 32.2MB
        • SHA256 960693fc9611743b899c079a7305ab2ba80859d6cff047769ac830c15816fc2d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstatd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
        • Size 31.0MB
        • SHA256 49009a5b257ad3c9e615eaf9fa74fa63676cbd928fc6f7215e114cc6968cbc79
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        keytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
        • Size 30.6MB
        • SHA256 1d4ab408eba25d17d2a7f98661f525979e5ae47b9b9048a5f5311a0ebe1c3730
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        kinit.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
        • Size 31.1MB
        • SHA256 899fa64bcca2a246af24d935045624adb67fc26d8914801ea13d5383d1735994
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        tnameserv.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
        • Size 27.5MB
        • SHA256 7593d988b9650b12f1ec6f6e0f2b93765985e3f8f5e15e936d7814664d809335
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        unpack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\unpack200.exe
        • Size 29.2MB
        • SHA256 1374fee97eb57b841c56df767084ce998fe33e29934534f4a7b8ca193abb4fe7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\java.exe
        • Size 25.4MB
        • SHA256 567d8a7b9d1d87fcf6894e1cd031e24819816a9c314496156344ffdec2477820
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javacpl.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe
        • Size 25.4MB
        • SHA256 a0fb9211fab0e8eaf0cfa5b27f61971baaf16fe0bf69811a240ae06290490b79
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaw.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe
        • Size 24.1MB
        • SHA256 107f8818a3d33e56542c8ccfabfff705d5ea0084737ad943ddbe7cc758e116bd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe
        • Size 24.2MB
        • SHA256 3b91ef1ff28215be3c90f21ef192b5c1dde37ca2a84a943f7df3c6df0e14c862
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        spo0lve.exe
        • Path C:\windows\SysWOW64\drivers\spo0lve.exe
        • Size 37.2MB
        • SHA256 b0b732dc0d3b759d7207123b217a3fd8d160852da7088c1b5644e27d01bc6171
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/2284-5-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download

        memory/4884-4-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download

        memory/4884-0-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download