Overview

overview

8

Static

static

3

2026-07-22...ar.exe

windows10-2004-x64

8

2026-07-22...ar.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    149s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    22/07/2026, 18:16

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-07-22_08c20d45c76567ee4f9694ce6ed86ef7_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
  • Size 14.1MB
  • Sample260722-wwe9ba1fle
  • SHA256 09f737beb17fb51dd3eab17039718cc4742aa68c5937ded6f41a20b22fdaea83
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
defense_evasiondiscoverypersistenceransomware

Malware Config

Signatures

  • Drops file in Drivers directory 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Sets desktop wallpaper using registry 2 TTPs 2 IoCs
    ransomware
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies Control Panel 4 IoCs
    defense_evasion
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-07-22_08c20d45c76567ee4f9694ce6ed86ef7_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-07-22_08c20d45c76567ee4f9694ce6ed86ef7_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:3540
  • C:\Users\Admin\AppData\Local\Temp\2026-07-22_08c20d45c76567ee4f9694ce6ed86ef7_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
    C:\Users\Admin\AppData\Local\Temp/2026-07-22_08c20d45c76567ee4f9694ce6ed86ef7_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:3656

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        7z.exe
        • Path C:\Program Files\7-Zip\7z.exe
        • Size 14.7MB
        • SHA256 13402c94890706aa67af045baa80e03f525a277d5ae07cbcb19dfcdf0743df34
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        7zG.exe
        • Path C:\Program Files\7-Zip\7zG.exe
        • Size 14.8MB
        • SHA256 23892b76d8d630148faec4674481c37d715f6188f04a2e6e1c90fd09adfaa57c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Uninstall.exe
        • Path C:\Program Files\7-Zip\Uninstall.exe
        • Size 14.2MB
        • SHA256 3ae5b1589e7f3b13616a313d256b08a674d92904d7433552a8f21cd7d3d67cdd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        AppVShNotify.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
        • Size 28.6MB
        • SHA256 ea3ff308a01a68cb4d3a26aa84179e66f0a528b57d80dbede872867f9ff9241d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        InspectorOfficeGadget.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
        • Size 28.3MB
        • SHA256 015cb7c46485fb37b6fd55fc8c3c1c70ead7b82ee5ad6b78eaf5cbe1aa8a1e3e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        IntegratedOffice.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
        • Size 32.4MB
        • SHA256 f460b5c29662746e3a3158e855caf8e649ead53c68d97ed0916868d97d209e93
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        OfficeC2RClient.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
        • Size 51.8MB
        • SHA256 13791949d94d2109a798ba55e5b806117c97917b5f869a8ad5dd1ac0a1427e28
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appvcleaner.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
        • Size 30.4MB
        • SHA256 a325d9e36a7ad6786a70f8ecb419f5c72112cb7668c7f45bf31dc578e9261b74
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        setup.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
        • Size 14.1MB
        • SHA256 09f737beb17fb51dd3eab17039718cc4742aa68c5937ded6f41a20b22fdaea83
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_pwa_launcher.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 30.0MB
        • SHA256 9d1633704ea54d4c9e022d178e7b884cec9a348c7825648973826702aa922081
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevated_tracing_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 31.7MB
        • SHA256 41f437bd7b5ce4f5f762c0059adbd023fb1c6c97f62699b02734ebc3de95a5b2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notification_helper.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 29.9MB
        • SHA256 c2494a202cbd0dfe90b2d0f71046b79c9dd1e92e65f1eb29c30a62ebdd32bd18
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        os_update_handler.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 30.1MB
        • SHA256 00e33c26966656a4830d66ae1f2f1769e1fa4c1d8f31e2243087af127b22e298
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 31.4MB
        • SHA256 a6b10589ad0381bad5e570de8e79760c8b5c74aaa4cf4e6a2ba73a9d3096896a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_proxy.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 29.7MB
        • SHA256 04522a428a457b5522c3aac34f7ac318ec8ef64b810d7b643094ed2e87233a37
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 28.3MB
        • SHA256 36b1243aa70ff3c77dcc2972073264d04234de020468d1bad6c98b7d470bbc6c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 28.3MB
        • SHA256 ba84806836d0a97911cfc0ed80d13b4cc6e58b5a8f481cc7f6dc24826996ee28
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 28.3MB
        • SHA256 6756529d2fde3546e34e71ba77c83482791b13c1d119ce5b01766967b84de8b8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 28.3MB
        • SHA256 ef912c6d38d07ae4f54aac2b8b8b128d377c47ed4b2e34556bb55253ae794b60
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jar.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 28.3MB
        • SHA256 e1f79214927a5a505dadf8795afa2a0f58d8e58f488a603c29e77fc74907591a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jarsigner.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        • Size 28.3MB
        • SHA256 0fdb9495f2f8f51a483f7cad6dfb1514b6af9579d0a08f1a38d1caf2d16ab57a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 28.3MB
        • SHA256 33d25a744eed2164aab1443352e491f84826a75bc30e8e46109d88201ba00f48
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
        • Size 14.4MB
        • SHA256 462a9668c0e5713043f125ee8278a5888b8d4ce7cdb4baa433d5e0a2f8e49776
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javac.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
        • Size 28.3MB
        • SHA256 984baaad215a26ff2f75d0042fd71635db57fe355d7013036da365dc72a7297d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javadoc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
        • Size 28.3MB
        • SHA256 1abd237802528bc3029b5cc7846b984981a46229cd1afe7469da42ee9c3e8124
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javafxpackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
        • Size 28.4MB
        • SHA256 2dfcf8d5cb7e3cec3664f5a7d88f7d1527a625052199bd8ac34f7f801a8245ce
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javah.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
        • Size 28.3MB
        • SHA256 998015021ba8f1ec75e602ba5147fd4069a5dbe1615f0516685ed7eff3739011
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
        • Size 28.3MB
        • SHA256 fcaf974d9d19a6b6ce5e462b23f7aa5e2900544ac662afaf2c26494b69adde5d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javapackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
        • Size 28.4MB
        • SHA256 246b19c27d5ba0b7eb1b83f93e9394874481349fcdf0822601f67ef9715e634c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaw.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
        • Size 28.6MB
        • SHA256 088188973bd156cd65c255c0fc623fe46319fe10a423a0cb1d4f818dd3056777
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
        • Size 28.7MB
        • SHA256 3405223bdcb3dbb96fc3676ac240d8dcc555b293e830ce8d16eecf1423b3d140
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jcmd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
        • Size 28.3MB
        • SHA256 30b13d97eb15f96ecea487873b773f08ec2135b4143e7d8b931b0086db88a4e9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jconsole.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
        • Size 28.3MB
        • SHA256 49fea7b4a2c80a1e74453bdee4fba7f9be222e73235412bfa38c8552c9d5b78a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdb.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
        • Size 28.3MB
        • SHA256 e1c8aae4572665d8522d8669a200a6cd7a3bed8d6966fd7820d73a651e5b6af3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jhat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
        • Size 14.2MB
        • SHA256 553c302021342ded32b80f8b71b2fd3d9a38dd0bdf13629e9e3fe64a7a3e9582
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jinfo.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
        • Size 28.3MB
        • SHA256 016aaf68c939ddfa4a8051e045d8b72936c3530f987773f40b4ad1f07be26375
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jmap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
        • Size 28.3MB
        • SHA256 a4ec5a3ef9b36931522826d022a130a055139a9a33d11d348e6f137a2d44f76d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
        • Size 14.2MB
        • SHA256 c5985c3632d507d0d89cc485aebda8fdb781bdaa33f799135e0cf988fb3e4f86
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jrunscript.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
        • Size 28.3MB
        • SHA256 c645df0d4f44047b6f1edf48f926cec58152f6a5423a1af61d0b2ce13c218f40
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jsadebugd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
        • Size 28.3MB
        • SHA256 96689ae0679f9b72575b34d3e6527467d2f66b68566e2fb7fa4c413aa40cd9ae
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstack.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
        • Size 28.3MB
        • SHA256 c67e068bc9d781686147a4edc7bd606c178de75eb5e726c79d2753710ae284ec
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstatd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
        • Size 28.3MB
        • SHA256 fed42ae404a386e6e3f437e4f6375c4459188761a8d9447a0058711600f059f7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        keytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
        • Size 28.3MB
        • SHA256 9bbc77de0f064238d2327ace16fa691bb42edfa30b5cae43335bbc284bfc2956
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        kinit.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
        • Size 128KB
        • SHA256 43487443e34438846ba103b7924eff4a32e10c362356ffe679e3f7f007a74316
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        klist.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
        • Size 28.3MB
        • SHA256 129d6c69d333e6f5c5e29102a6d266e45627a84f9b4fbbc1f9e09de9d81efadf
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        native2ascii.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
        • Size 1.6MB
        • SHA256 067d7f527b4692d084e4564d7ac1325361c4112745ef6eb09e50ff66c09d43ce
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        orbd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
        • Size 28.3MB
        • SHA256 9b3115110c70a422bfe2a465b29a3e76df3bc8ee5216f3f5518795fb31530a33
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
        • Size 28.3MB
        • SHA256 655d4babceae963111199aedab579a4ea1af7eab4ee1ca3fc3ca76874c104646
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        policytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
        • Size 28.3MB
        • SHA256 51e3ee9f9956b5eb666e7d6fb839609299820f93a696109c835d83076dfcd28c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmic.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
        • Size 28.3MB
        • SHA256 70a92e668683440b13445e15771cad5e60891708d62355e8b108b6b64e014a37
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmiregistry.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
        • Size 28.3MB
        • SHA256 1f7845d889374c1d0117fd3ee57a8ae2139712446051eed22edd5191d840ad88
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 28.4MB
        • SHA256 b2275b0c51e2ce9e97b0a8459f37a3650e1338311e36fd0b4f5e7804ff867e00
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download