Overview

overview

8

Static

static

3

2026-07-21...ar.exe

windows10-2004-x64

8

2026-07-21...ar.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    150s
  • max time network
    127s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    21/07/2026, 04:23

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-07-21_0a3c0f1694a73836bd94f3398a6f967c_amadey_elex_emotet_icedid_remcos_vidar.exe
  • Size 3.2MB
  • Sample260721-e1ae7aez3j
  • SHA256 ef5a51fe3703b845604c05ebdb6e71cc123c338bf17fd3868ed4e099532d5146
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
defense_evasiondiscoverypersistenceransomware

Malware Config

Signatures

  • Drops file in Drivers directory 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Sets desktop wallpaper using registry 2 TTPs 2 IoCs
    ransomware
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies Control Panel 4 IoCs
    defense_evasion
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-07-21_0a3c0f1694a73836bd94f3398a6f967c_amadey_elex_emotet_icedid_remcos_vidar.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-07-21_0a3c0f1694a73836bd94f3398a6f967c_amadey_elex_emotet_icedid_remcos_vidar.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:3316
  • C:\Users\Admin\AppData\Local\Temp\2026-07-21_0a3c0f1694a73836bd94f3398a6f967c_amadey_elex_emotet_icedid_remcos_vidar.exe
    C:\Users\Admin\AppData\Local\Temp/2026-07-21_0a3c0f1694a73836bd94f3398a6f967c_amadey_elex_emotet_icedid_remcos_vidar.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:5380

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        Uninstall.exe
        • Path C:\Program Files\7-Zip\Uninstall.exe
        • Size 3.2MB
        • SHA256 ef5a51fe3703b845604c05ebdb6e71cc123c338bf17fd3868ed4e099532d5146
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        AppVShNotify.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
        • Size 6.7MB
        • SHA256 588ad1e002140bd3b3a0e8e3a3348394a9b4c6e071485c29a200a14d0d2eee71
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        InspectorOfficeGadget.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
        • Size 6.4MB
        • SHA256 7b8ba9cc7e935d1cb7130cd294812c4f116c76347967159d3aa3451b889351a2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MavInject32.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
        • Size 6.7MB
        • SHA256 2c0befadee58cd41554bb0f574db7013a55cd68bb1aed7e077319de64de4c20a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        OfficeC2RClient.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
        • Size 26.7MB
        • SHA256 720df29d3c86ef7d5b1016aab55d194a60df2843134e7bdf84d34f5ae2fe2917
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appvcleaner.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
        • Size 8.5MB
        • SHA256 cea88f5e478e48ada3dbdcb5d32337d8f2b133c6ea88faf0381e35daefd23b8c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VSTOInstaller.exe
        • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
        • Size 6.5MB
        • SHA256 7dce4f13209ae47276d78d3209d9b4b4ad80d2b40bd59d701431dc34aa6619a0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrmstp.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        • Size 12.4MB
        • SHA256 b851da54f3a02a92daf1c1dc1ecf07c7b83f4d2e9ba92f9b6fced7d8fe9ee503
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_pwa_launcher.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 8.1MB
        • SHA256 b0bfdc234f65e33f12249f4357751ead63f90ca7fee49c1b7c819215e2372274
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevated_tracing_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 9.8MB
        • SHA256 4dbab5f648a3661e55fd8e9684335ba7188bb6e8cf416b0d2213aaf42232c732
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 8.6MB
        • SHA256 d7f8b3a5a979dc779d8365f0e6f0161b86db2b71eac5aff7450ee61e4a07854e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notification_helper.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 8.0MB
        • SHA256 c23c140e9e4fd99d65e576b83b3e495256dce5e377e59868de305ceacea7f189
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        os_update_handler.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 8.2MB
        • SHA256 0ebf6df891ec069c0b172eb20f91bef3d80db8507915818b9a7ac12fde83323d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 9.5MB
        • SHA256 ac17081c722534bdede4cdb18200711a4d280da11bff7c6d493287165e08f7b0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_proxy.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 7.8MB
        • SHA256 599dc7f6850cb78388da883a9614f3b813763f2ec58e3a5488d72f8dbcea699c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 6.4MB
        • SHA256 b6102ebed48a10d9f63c85410171a23a80dca7f8a30862336fb2e10fb43a54c3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 6.4MB
        • SHA256 dcf60e2950f9de00a61a85b3455d6dded44642cb6b9c8f540d0e6cf82cfa8b2a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 6.4MB
        • SHA256 e0de8f20ed584e595ac61ca423dc15fa9341e50df6f67263a7d72cbb118c8fcb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 6.4MB
        • SHA256 62c1f60fc865dc1fc5384f20e652de9c186f1a21bb200cfc9aa828420a733a3a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jar.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 6.4MB
        • SHA256 bb0687dd987ad674dca4a6f4efc95dd479855e4d286f99ab9a5b4a083823cb01
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jarsigner.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        • Size 6.4MB
        • SHA256 83687169aebf7a8712251ed5b14988f92f900a9eedfd8c3dc2a8d692c3e8da5e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 6.4MB
        • SHA256 ea9fb6aef6d156659dcf1269ddb9be27208da49417c00d19f249c1f68201859a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
        • Size 6.7MB
        • SHA256 c7e26e3132cd36f548887077ae6cca4576af6bbd654d4c27a2a28c42d9079412
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javac.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
        • Size 6.4MB
        • SHA256 abc221c283e197b8100297f0ed89ff48b9da68b28444d935afda79a01baec39f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javadoc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
        • Size 6.4MB
        • SHA256 2694a2f4beb85121ab9f8d4d46631a23daccd7b18096958b0043b0e427412b19
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javafxpackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
        • Size 6.5MB
        • SHA256 9a3b31d13c5096aff62a716097cc1af72ce9c6466660cd1ae6687ff761cd259e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javah.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
        • Size 6.4MB
        • SHA256 7ecf0c61c3ad8a62623ec002721dfe2b8903d48e2302d750a3640f44026667be
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
        • Size 6.4MB
        • SHA256 c39de41fa035740073afaea5bfacef113097258432218cac193881006f2192d0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javapackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
        • Size 6.5MB
        • SHA256 1b2d03647fb20cffcd04d81ab94e13c8f98c84ae1ebda6edae2a57e7f1dca5db
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaw.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
        • Size 6.7MB
        • SHA256 d35006d36f1a16f0610725ff2594e488a7e5bb365783aa0a49c72f6a1b2827d6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
        • Size 6.8MB
        • SHA256 7102d5b24f4c0bacb1bfc4dde97434a1dc84074d5cf9f72fb083eef52c7a7aa4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jcmd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
        • Size 6.4MB
        • SHA256 d882e1accea303bb3a898cdce092a9d17cb6064cad5da1ede04fd65228ac5f9b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jconsole.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
        • Size 6.4MB
        • SHA256 4f665e49f0c0a76bb2ae8da95ad5b03de6c8c24f2fb8574d4854c9848d805f27
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdb.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
        • Size 6.4MB
        • SHA256 092aef4c1ddbb9bc9f188ccd9c787329e1284de871f5d97e1a411bc3cf05a7c9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdeps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
        • Size 6.4MB
        • SHA256 494f15c7eb9b5c80533d10afbb78f8ed72c29e749b3708ea4737660021b8b73f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jhat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
        • Size 6.4MB
        • SHA256 a4a61ff940f7068f20c0f73ef06bc21f43ea491f5603465b95835678000730c3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jinfo.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
        • Size 6.4MB
        • SHA256 45755f3ad8fae957d8b6a4626dd5e6dc45da3a36bd53ee8e61b0d9f14b2b76c2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jjs.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
        • Size 6.4MB
        • SHA256 b397dc8df72ce0e191b7335c188ed3d6b5d9111792cf3cfff4ca36ae27920661
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jmap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
        • Size 6.4MB
        • SHA256 349e81afe1db733bfc6c385917e9973dcd7f85696de6f06e15504998131ee4d7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
        • Size 6.4MB
        • SHA256 3a6eb7c6adde51fa8548a808c90d5a874201c908eeb07a8736a2131de07a0a5c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jrunscript.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
        • Size 6.4MB
        • SHA256 65c5666741abcf72a535aa8c2646dac58ee108e0b610ae4c860f50b323effa58
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jsadebugd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
        • Size 6.4MB
        • SHA256 9143bb242e7eee7b6d3a9b8a599aaf6da9d044c30b422f8aae224e26026a5f36
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstack.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
        • Size 6.4MB
        • SHA256 d7bb553d5bdda67a8449ca461d3de603dca181c9c92ef136a65925fe4065ac83
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
        • Size 6.4MB
        • SHA256 68e8bc8aaec4bc754bb5ea3a02a2bae86cd4cb04dfcd3264c80bc66ebc69a259
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstatd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
        • Size 6.4MB
        • SHA256 a8890af69cb33ded4ed9e44df92580fdbfb85a615ca27bbea8cd06c576efb0c5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        keytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
        • Size 6.4MB
        • SHA256 051e58dde1e12226d97493cbdce60fe78b83de243c9dfb0f2b41e000369be8ea
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        kinit.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
        • Size 6.4MB
        • SHA256 9de8389082cd63ebd9cc23476788ff7bfae0e7b6125a9a1d1a872337c4ca12c7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        klist.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
        • Size 6.4MB
        • SHA256 f590c58b1f2b33002af836e5004e9c24986c4bd06d0664463aabeba1e85d8ebf
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ktab.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
        • Size 6.4MB
        • SHA256 0a122ef52ec3b57d623dd5fc6ac2ab186fc4bd8cedb7ba28bb1746bdbb8ffcda
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        native2ascii.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
        • Size 6.4MB
        • SHA256 c837e917cd5ec4eeb680a580336bb91dce05faeff406e0bd0affe14c56fd4678
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        orbd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
        • Size 6.4MB
        • SHA256 a5d3e789cc69ec1088c77265813ffb774deecc930dadceb26088458b15e3d411
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
        • Size 6.4MB
        • SHA256 a384bd022e9e440b4e9948344b725e67f5ee8e348f63b65e6864bea46d7c510b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        policytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
        • Size 6.4MB
        • SHA256 ef4d2bcf3f54b98aceb3bd79932fce4d2f75485aa0a90f6eeec815102e378d2b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmic.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
        • Size 6.4MB
        • SHA256 57ed3f2a3be342247aa6486df0d137fcbca2be0fd54ca028eb08f8b120a86f07
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmid.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
        • Size 6.4MB
        • SHA256 db56f77f5a829b1c06e1cfdd8e1de8481dda1d70b5400db06c265827ee3bb771
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmiregistry.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
        • Size 6.4MB
        • SHA256 eb2bbf123169f7d489f8d137c687f34ee6a05f766f9dfb40bff01a4de94ef736
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        schemagen.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
        • Size 6.4MB
        • SHA256 b22d4eb690ae72b5aaa484aead7c51a8b69c3b65b9e5a29c18513d78560a445a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        serialver.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
        • Size 6.4MB
        • SHA256 239df93b8084b7bf92a25cbd523e49679dfdc49d8daae4050844cec1bf6b007b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dotnet.exe
        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 6.5MB
        • SHA256 6b520d5d319eca0febccd5475228343abce8c782d8c02653b2a9bc8510d0182c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 6.4MB
        • SHA256 0facdd97d7c1c22c0ee41025cc94c9512d51f41a4b18adaacda196e7aea6db3b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 6.4MB
        • SHA256 daac719433769a5921ce4c1c5344b0ceb3f999c7085a9c7c9dc9577ce94fbe40
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 6.4MB
        • SHA256 c8d1e3b5c67d13bea13a652e3e9eb1ebeb517ddcc32f0d81372b9ae3b645dc7e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download