Overview

overview

8

Static

static

3

2026-07-30...ar.exe

windows10-2004-x64

8

2026-07-30...ar.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    27s
  • max time network
    136s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    30/07/2026, 01:00

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-07-30_ffed58c7f22353be7b92a19a41480e98_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
  • Size 22.5MB
  • Sample260730-bcnq5awdpc
  • SHA256 3eb59629ab3696631a19acb49826ce6b81075977a7ef3ea618d157ad298003a4
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
discoverypersistence

Malware Config

Signatures

  • Drops file in Drivers directory 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-07-30_ffed58c7f22353be7b92a19a41480e98_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-07-30_ffed58c7f22353be7b92a19a41480e98_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:5892
  • C:\Users\Admin\AppData\Local\Temp\2026-07-30_ffed58c7f22353be7b92a19a41480e98_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
    C:\Users\Admin\AppData\Local\Temp/2026-07-30_ffed58c7f22353be7b92a19a41480e98_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:2232

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        AppVShNotify.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
        • Size 22.8MB
        • SHA256 03f23b436409ae383d26c0ee42c0b5a6cf95a5ebfd500734c01deb1e3c4fdfb4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        OfficeC2RClient.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
        • Size 46.0MB
        • SHA256 49cf6265f64485a1c1a6b52bf1f33b146a4b21349139274630b3f0c8f2bdda23
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appvcleaner.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
        • Size 24.7MB
        • SHA256 1b83d43ad81e95fd6d38ea7f22a85dec2966c21ac0a63af5679a083d19e19c65
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VSTOInstaller.exe
        • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
        • Size 45.1MB
        • SHA256 a339e4f861a5dec4e079a02c66f264f94a944e57e92a5e3fe82e3adbc52cc6f8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        DisconnectAssert.exe
        • Path C:\Program Files\DisconnectAssert.exe
        • Size 45.3MB
        • SHA256 568d0d3c1f1be573e59596203d7142cf4bf8e26f6e83a58ed7fa0c83b616f637
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrmstp.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        • Size 51.1MB
        • SHA256 7b7a963e962c7916f452464bd5da5c431c2ecdfd52cfd2470f9ed71ffef9ce08
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_pwa_launcher.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 46.8MB
        • SHA256 88813fac649cc4731bd92cb06f402a6eb4618b23541bec47fcfa5d47542d8cb8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notification_helper.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 46.7MB
        • SHA256 f7a5ea41ab992eaf176d5955bebb3c2b11bad40004c48d336cc51c686f35317b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        os_update_handler.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 46.9MB
        • SHA256 0662fb8456e9d43d76f4bc12ef09ce55a10846eadc2058b48e966c590b9d057b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 45.1MB
        • SHA256 5ecda32149d3535a3b12aa975affac31f3cada3797a97da0790c78b5687a1d9f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 45.1MB
        • SHA256 43fa81cd5f55b87f4a2cc16595cfa3a178530e11c952ad11abf591efe1ea379b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jar.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 45.1MB
        • SHA256 8366053a3ee70860b22655c65f333d80b7559ece6fb5feb6f3710315c4bc02a3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 22.6MB
        • SHA256 36d655744ac96350c1ac5451adad7b40be2bb86c52fcff1e1586814587a032cb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
        • Size 45.3MB
        • SHA256 96f12b3d83e3ed2f790ae6e0eb6cc3fe50ffcbeb2fbfa992eb06c17078bf9c20
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javac.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
        • Size 45.1MB
        • SHA256 897cbaa5b8adf33bf97454990ddf4850a73dee115feff2dadae2e7a9e45d5365
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javadoc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
        • Size 45.1MB
        • SHA256 3df97bf4d196b108b67b79fc2fe5cae3e72d361f82b5c390338ca4c3cef51892
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javafxpackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
        • Size 44.3MB
        • SHA256 a22741881245564e28df7adc52f52d9e2e59d718c3fb5393c5dc77866c5dd87b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javah.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
        • Size 44.1MB
        • SHA256 cee68cfa1df8ea368644443ea86080de8cfe327bf3482b05e6c8c0914e29fd4c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
        • Size 44.0MB
        • SHA256 f8a578537751d605a0128c55dd7ffc8435f9db77a1c30d94ff2b27688df6a8a4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javapackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
        • Size 43.5MB
        • SHA256 451aef977d871e6a396d494b827b244ab476a32adddc4bd3f1fdce5269bf38ae
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaw.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
        • Size 43.1MB
        • SHA256 db5add4427248df2f2e3c54773b45d71ad59ac14777f5bdc4d2a19468cb7f36b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jcmd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
        • Size 42.9MB
        • SHA256 f08d3efc7d7d22bb37bdbf43c0909e6ed31b8d9d5f1db9345b4a192b6439abb0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jconsole.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
        • Size 42.6MB
        • SHA256 39cfa666302d21c26977b73d5e36ac376951c4a1be55f41135c831a8e1a94d53
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdeps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
        • Size 41.9MB
        • SHA256 a7e31454dbe73681d6585f17a9490452d9d0fab1c3267d6ae98fdee87335a13a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jhat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
        • Size 42.0MB
        • SHA256 5f3786480a9c48d385e339784809d4ddb3b2a344c056acd4b7dcd1e051b9a631
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jinfo.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
        • Size 41.9MB
        • SHA256 aac9d2f61e3ba11167099ca755771a29c8a13cb4db7e5d2a45ae04a52dbe7041
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jjs.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
        • Size 41.8MB
        • SHA256 89e816c4d9547d50fe7844820181b3e24de169181caeb321f8276048df4fd1cd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jmap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
        • Size 41.5MB
        • SHA256 f3279abfd379c6d4850042b99529fbb8310a3986a3ad834b3c7663655d4a4222
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jrunscript.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
        • Size 41.4MB
        • SHA256 8d4232a0f94cfe7f335ff06ead8f23ab76f832becf1eeb1bc18f7979f7622b65
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jsadebugd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
        • Size 41.2MB
        • SHA256 e3febcc3c94b8677418ea85fc9863b5298cfebc90d1e8fff22a95da07cf2630c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstack.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
        • Size 41.1MB
        • SHA256 a1640c60d8478054189e83c4ff385d67577bcce003fb269e9c1a59e293f521cb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstatd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
        • Size 40.9MB
        • SHA256 7a264e05052f29ac9e185a2fef6cc4c25c713b673bb5dc153d6ed9b9d5b23cc2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        keytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
        • Size 41.0MB
        • SHA256 e3dcb6a026b9467640b43f6b147ce5dcb9735124ec71872d3cb98f5c0c1ce3c4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        kinit.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
        • Size 40.9MB
        • SHA256 1f36a8a637cc5fbcdaf15ef8d58584ebedd73dcd0b21fff8d4ce4d00a08ece24
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        klist.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
        • Size 40.8MB
        • SHA256 4c11f2fe731fd32a0362a39b8fdf569205ae7cff881369ff58b3fc6ab5c3b59f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ktab.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
        • Size 40.6MB
        • SHA256 f0792d1eeed43645bb113c698845edb888965bfc2410ce6047dcefdcc03aff40
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        native2ascii.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
        • Size 39.6MB
        • SHA256 b010791807909f1babe9d622b556729e7283be464c7bd6f5c465ec6875c8d487
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        orbd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
        • Size 39.2MB
        • SHA256 1cb200e0284cb3cdc8501980ff1219491f6593b6c5b31923dcc97e6b1ade8b14
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
        • Size 38.9MB
        • SHA256 9fadc5e27beaa143f9dd98d6c3d0157d8e979f279e393179f45bd2197aa408c8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        policytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
        • Size 38.6MB
        • SHA256 02ac5b49925c7e5bdcd4844b9ac216bf9445e3477263a5cefe999ca93d1715fc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmic.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
        • Size 38.2MB
        • SHA256 8e175c7f02d38cad5a0c54ac2b47636b9b23590e0ba27fa22b47581f074a3be4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmid.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
        • Size 38.1MB
        • SHA256 4df37ef0865f9a2149190e865f465d68830724e31ae1a6bd6685aaf92a63c62d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmiregistry.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
        • Size 38.0MB
        • SHA256 fdb9fb611b5c4631b18746eacb998ad03916e9d53e48066ba97df40b9bcbd6ef
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        schemagen.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
        • Size 37.9MB
        • SHA256 13f5454b23f29731ffce0657be1eecd34873e37c2636de93071c1a40e990b954
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        serialver.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
        • Size 37.8MB
        • SHA256 42f855109ec5043d4646727269209d3edaf4b26eec92627f5804649a083e6b83
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        tnameserv.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
        • Size 37.6MB
        • SHA256 659b75aed1edd591d7fa56f5668f51349ca5f8c4132ea9ffdccdbeb02e2616c5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        unpack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\unpack200.exe
        • Size 37.6MB
        • SHA256 378d00589dfd4c2ef90a37df7adb34cc67563868d5f013f55635a0003ad58c46
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        wsgen.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
        • Size 37.5MB
        • SHA256 4620a70404898adf5e44b897fb5bccddaa2bccb3c70ae4b66f749f022ca2508a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        wsimport.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
        • Size 37.4MB
        • SHA256 14d0d946003d9e1161a9c86524640a159fd09a3e4048cba0b41c43970335935d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/2232-30-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download

        memory/5892-0-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download

        memory/5892-12-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download