Overview

overview

8

Static

static

3

2026-07-08...ar.exe

windows10-2004-x64

8

2026-07-08...ar.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    41s
  • max time network
    125s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260706-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260706-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    08/07/2026, 17:09

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-07-08_ac62c0955a223604be150861c73c90e5_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
  • Size 37.2MB
  • Sample260708-vpgccsc16k
  • SHA256 b0b732dc0d3b759d7207123b217a3fd8d160852da7088c1b5644e27d01bc6171
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
discoverypersistence

Malware Config

Signatures

  • Drops file in Drivers directory 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-07-08_ac62c0955a223604be150861c73c90e5_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-07-08_ac62c0955a223604be150861c73c90e5_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:2408
  • C:\Users\Admin\AppData\Local\Temp\2026-07-08_ac62c0955a223604be150861c73c90e5_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
    C:\Users\Admin\AppData\Local\Temp/2026-07-08_ac62c0955a223604be150861c73c90e5_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:2732

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        AppVShNotify.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
        • Size 37.5MB
        • SHA256 1d2eea2d7105bea591e3a5c0b4f455d6c4a939b2298c72415f65e8a8aa22b5f8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        InspectorOfficeGadget.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
        • Size 74.4MB
        • SHA256 ad30780f2ecca467a8f42f48ca0ceb7e36e5004d1b951324a48975ee1f4f40bc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        IntegratedOffice.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
        • Size 78.5MB
        • SHA256 85829143a93e2b39e19b8b779478cb91c93269fc12c46abcfc478924d6b315d5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MavInject32.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
        • Size 74.7MB
        • SHA256 3048a9d63708066268c842b5d8e6c0a65ca77e88075e1d3366238c5d9430be7b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appvcleaner.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
        • Size 39.3MB
        • SHA256 f8b3aa50cf5251e4d7a36fb8bcca6b4dacaa595c94b370d31faf8de867e1c949
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VSTOInstaller.exe
        • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
        • Size 74.5MB
        • SHA256 8ad964837bcb49a720eb9435b35db441d1f570757bd7e6f5eedcf26c494a9928
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        setup.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
        • Size 79.6MB
        • SHA256 702282cfcb1e572d3d7034fcf373c5d7bea45e9ef977e17bb20c599cc748137e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_pwa_launcher.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 76.1MB
        • SHA256 3bc2059cd664f9836a9b8347bbe655a8d6af671bbe994925c4c9aefeb7b85a4f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevated_tracing_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 77.8MB
        • SHA256 4c4d3777a885466a1db4fc8dbf262ada26bae3eb2cd0fea648ddf2ddd333fb8a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 76.6MB
        • SHA256 67ddfc59bf69a69506174eb4bc124a50e4d840cd108385aa79651df1edf489c8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 71.6MB
        • SHA256 38d4533c34638bf72e754abe354be462eeaaef409929ca1d19c2e191384edf48
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jar.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 1.2MB
        • SHA256 a12da995e28fbdcc6d83e66892669b6cf4b2779ef75e5d7dbdc6be6b8e0307ff
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jarsigner.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        • Size 70.6MB
        • SHA256 4285c0e15980c5e9606315b30aed66fbc2cfd6009c728dc231171d8b3e0eb4a8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 67.9MB
        • SHA256 55ba1e8d862fe1dc1a1263560a190cdc2295b53251b0483c3da5f41e00177a0e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
        • Size 65.6MB
        • SHA256 b4f529fad47df3f6ea3d09c71e04bd07ff054c0c6fe1c7752e12d8c0dafb6675
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javac.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
        • Size 64.1MB
        • SHA256 3702615ad738527bb9245acd453a4b78e1790d18d375bfb070f4c5b50e6b2ad8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javadoc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
        • Size 62.3MB
        • SHA256 dff92c7e593d987f7f785917327ab42f1dff45729b3c50c1e1266cece9c8b108
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javafxpackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
        • Size 60.2MB
        • SHA256 95d207b29e242a58b2d259f801587ac67017be7355cf7cceebf57b071627e161
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javah.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
        • Size 61.3MB
        • SHA256 c8835cd0a1aa3edd915f3b3ea711abeebd7a25f180c68cb094370ab30115e4b0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
        • Size 60.5MB
        • SHA256 86f74ccd22dd0a5d74c6e70832e2167affc3eee8cf08d54f8cb9d48298e17867
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdb.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
        • Size 58.1MB
        • SHA256 7e6a36d3c5682cc026864d373ced22718384e1083040fc74ce55683df7df4d9d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jhat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
        • Size 57.6MB
        • SHA256 9b0d7e8aead0e9b75aae4b004fda160da9185c554a39a10e8eab550cb197468d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jinfo.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
        • Size 56.9MB
        • SHA256 8ef5a1798c69025b8d45a10ac9a89da9d07692693a7e4c38a47b9227b5b36bf8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jjs.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
        • Size 56.4MB
        • SHA256 55374d70bd7f14e252f301a83ba6447b8e32ab603d0a66be058ebf5a7582e8ce
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmic.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
        • Size 53.0MB
        • SHA256 0c28dd7f2f6b5ba756647a0ffd996cb401f79e72080aa92e6397995e51c6a745
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmid.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
        • Size 51.9MB
        • SHA256 39eb8afcdab17add8303979652c85be78a3c0da3bb792d76744c0892cda716d2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmiregistry.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
        • Size 51.0MB
        • SHA256 7daa601709f1fae13f6b0deb24337c5fc9d12928b4970ce3bd7b92f12d24ad7e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        servertool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
        • Size 49.7MB
        • SHA256 7cf90cccb88bc3bfa60576e4f39c371bca23048e0030aea05929d775e2ce6bdc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        tnameserv.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
        • Size 48.7MB
        • SHA256 6d6267703acf3c0f8f5180d8f7d64085a99910b0ad77f173ff4039f4c6de48d6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dotnet.exe
        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 74.5MB
        • SHA256 3e59a52355227b8f0853ece0f86aea44100c17fb2cec4b5a86a1938575c088b7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 74.4MB
        • SHA256 db9c4000c593a96414decc8797edc42ecdf735a8f7cb02e5da60f012bbf15889
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 74.4MB
        • SHA256 112d5e3f4186e300e000a4c9f9757f41b272cb8fe72b1848be0bb6d6d1e5ce9b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 74.4MB
        • SHA256 25a6403dbd08c5256b607cfd13172403df70aae6cb3bca98d5b4e7a881494bf8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/2408-0-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download

        memory/2408-1-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download

        memory/2732-14-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download