Overview

overview

8

Static

static

3

2026-07-30...ar.exe

windows10-2004-x64

8

2026-07-30...ar.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    28s
  • max time network
    154s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    30/07/2026, 03:36

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-07-30_43d9ba6396bfd38bb73eaec7c04f75af_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
  • Size 22.5MB
  • Sample260730-d5x7dastc1
  • SHA256 2d289676fdc0babccc4efd6232f613265ff5b32f44024d67dc1a9a801dbbdb6d
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
discoverypersistence

Malware Config

Signatures

  • Drops file in Drivers directory 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-07-30_43d9ba6396bfd38bb73eaec7c04f75af_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-07-30_43d9ba6396bfd38bb73eaec7c04f75af_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:1492
  • C:\Users\Admin\AppData\Local\Temp\2026-07-30_43d9ba6396bfd38bb73eaec7c04f75af_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
    C:\Users\Admin\AppData\Local\Temp/2026-07-30_43d9ba6396bfd38bb73eaec7c04f75af_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:432

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        IntegratedOffice.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
        • Size 26.6MB
        • SHA256 5915049d91354967f72809277c049e1dc7f687efab390c81339d6e43a913bc6a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MavInject32.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
        • Size 22.9MB
        • SHA256 af24dfed218f4ca09a920b6035b72505c05be30558568f8fa0b77f835d76912f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        OfficeC2RClient.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
        • Size 46.0MB
        • SHA256 7c08bea03a1d2bcece5b38af619dbc0abc53543f4fbe8b2b917a690930b19a8c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appvcleaner.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
        • Size 24.7MB
        • SHA256 cd67eef3bebda285c7fb88d7df55880af364aad54d9d04d5df0646b9d0b878e4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VSTOInstaller.exe
        • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
        • Size 45.2MB
        • SHA256 1059bccd07c268b6bf7c21381e1d8b047f2ad733fe97ba98e1524d84ab02424b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrmstp.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        • Size 44.0MB
        • SHA256 faf2927ff6c2a1a7f9c92c9c25cce7674b3a16ad8c4538496f4f64bd712f27b7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        setup.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
        • Size 43.1MB
        • SHA256 59879daebdbbbfd87e6675fd79d9f5053af435c99458c00c7966a07faaf2db12
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_pwa_launcher.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 24.3MB
        • SHA256 c76efac5f0145e992207bbb4472227d1c7375104069e659683486a3a86f57716
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevated_tracing_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 45.9MB
        • SHA256 f7780280cd44f02c29647797da480d52e67d3b85fa1908f70ea5918223d9cd23
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 44.1MB
        • SHA256 88db2f393f8aa11c0dbbcd1d84d35a50b07e48987a6d1d53875273adf051493c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notification_helper.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 42.9MB
        • SHA256 36bbe730ee37dc8be426670dd16d31164c019a85ae2b270d8de34fe864979dbd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        os_update_handler.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 42.5MB
        • SHA256 b48b8543eb3bea262cdf3bb84b31f3cafda9345c07c029737a1b290762279db0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 41.3MB
        • SHA256 e679a4760af039828082965b854c274955178207233db9eee0e902e53ae27fe0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_proxy.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 38.6MB
        • SHA256 fc9c21ab7ad4605fb8fb6e0d49d7107f0defbbe79c8b47529feb3b69fa9a7e28
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 37.2MB
        • SHA256 7057d135cac72414b3fa8775ec3033cc58c9d6512e060afc93f05a29fec062e7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 36.9MB
        • SHA256 6e1c572e68430b09a63a7274ecab567fb104a6f7c9a97e5cac3016fb0646aa04
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 36.3MB
        • SHA256 66f6e0dc8234c252f4f4f4fbbf2c0c313516d6f9344977cf63d92f394f6661d1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 36.2MB
        • SHA256 2bfd3cd47eee5b0351f02cb16ba6db048bcecddbd925485c8000568766fb8adf
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jar.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 36.0MB
        • SHA256 580641e9d0a529ccbf863b319e389215d991f1094c7cbb940905ba024b351a8e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jarsigner.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        • Size 35.5MB
        • SHA256 5ea1a8264c48789ff0027f81511b51e32df368045218b5ec34edb07728e6c8f4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 35.2MB
        • SHA256 2628138549984e14362fe41ef55afd1833df2dbe40065166d980857d919380ac
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
        • Size 35.1MB
        • SHA256 11ea2ee56e07ba5ee28aa3aa74c68b1be2d6b4881c12e51f89f73d31ddcdcca7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javac.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
        • Size 31.9MB
        • SHA256 989620e8683dec5449b38e4ecde8e04f294d311afb9e42fda3f5b2c3c4fb90d5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javadoc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
        • Size 32.0MB
        • SHA256 a9f6b1641063c2b1098bce27e096b1029f67a63eb70f404c609bd424d0f93f41
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javafxpackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
        • Size 34.8MB
        • SHA256 0984eea30386c8946db564adbbc98f20e10b6dc3e5990536727aac4d708fb697
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javah.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
        • Size 34.8MB
        • SHA256 5d5732d3bb398836a97b095527db7f99c14778f50b54ace50f6b550cbe8e7250
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
        • Size 34.7MB
        • SHA256 581d53a2ea5789c685f4c5544892cd5623fd4e573191cd4a6954049fc36ec7a2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javapackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
        • Size 34.6MB
        • SHA256 8f9bb54e90e854828829d2b0d79702d4cababf89acc93f3b04cbb8d0594369dd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
        • Size 34.5MB
        • SHA256 26d2169f5350609356ab3d72d62f77a1ec86224b224c65b872b77b2ce028aa5c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jcmd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
        • Size 31.4MB
        • SHA256 4d93333f39513e735a16c7151a9e6beed5ceff41104747c62fa52332a5f24007
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jconsole.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
        • Size 34.3MB
        • SHA256 e3ba5708ea098afa474c83da75c776ee97fecddf321efae6ac8870f1703b52a0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdeps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
        • Size 34.0MB
        • SHA256 01a52317b36d859d314f0960ce59b30296976bb743af4805ec2fb867fef6f11b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jinfo.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
        • Size 33.8MB
        • SHA256 2006f9d9370eeaab24442b926d3283473a6c2af4634be043d8d405ea7d75c72d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jjs.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
        • Size 33.9MB
        • SHA256 9ce2180ec1c47cd21d96d0388f7a64054659852fe062533710921deed0db319d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jmap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
        • Size 32.2MB
        • SHA256 bd7cb68ba585aefeaeefc54ea348a29cf943b52c0248a964e9b32337cbc745d4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
        • Size 33.6MB
        • SHA256 056cbc4fa14b5fd8bf0e3492b6ade482a814da86fb7a532c27eb04190786bce2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jrunscript.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
        • Size 33.7MB
        • SHA256 3200738c69717a37b56b2803bed97368f992e11c06eb085638c69a0d813372d6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstack.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
        • Size 33.6MB
        • SHA256 11be94389f2d283aef799b79ffb7b2855b5d8b86145ad924605a23fdda53fb25
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
        • Size 33.5MB
        • SHA256 095a8aadb187e8ad203afba5669ec1403e5bd8330ea62e6f42745186b2426e58
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        keytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
        • Size 33.4MB
        • SHA256 4dfec5e67d2719ae2387c14412ad846b54e23ba2ab9d62754b6c2c03a768d373
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        kinit.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
        • Size 32.1MB
        • SHA256 8c91b91417681c2379a6e72b4434c29677a951c11d6bc8b4e773750b7840e5f9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        klist.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
        • Size 29.7MB
        • SHA256 1286a0b3ca0b8cde78c5eac59ff40639bbb4204c90a89a287ce7476dba887305
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ktab.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
        • Size 7.6MB
        • SHA256 9de182d78f49efbce0db1684fe6f678643799ca2a8ee2ae49e6e39f00e96101a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        native2ascii.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
        • Size 7.0MB
        • SHA256 44c056e55590b2555c35a3b71ea2b699c462bc9197894d8ac46586da8085bcd1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        orbd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
        • Size 5.5MB
        • SHA256 35dcb2d14255714ea88acf0a7532e55bde9aa5ed3e3df7f72c3bd58216bd42ce
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
        • Size 5.2MB
        • SHA256 5e6562f00f7d9ad71a918064d2334177ca13738129eb9eaddcbeca245515e407
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        policytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
        • Size 5.1MB
        • SHA256 9f7c31b66652b18eff378ab867d34361a2b445acf5bab73cb03d3caf06e3e99b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmid.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
        • Size 4.6MB
        • SHA256 264ecd3622ad2af3bad97e726570aff702f5601521cfb70cd9357a497ddd195a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmiregistry.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
        • Size 4.3MB
        • SHA256 322940926a8c7ec4cf676f7a06218569b0e770c5e36176e1e2d36bd96ef3913e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        schemagen.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
        • Size 4.2MB
        • SHA256 adf0cd2e55bd0fef0ff35ca9b9e8b4e52ec606da79eb4f81b4c6c996e62d8490
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        serialver.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
        • Size 4.1MB
        • SHA256 63dbbae0fdbb178995a2b2b13496ff7d7487b2471f0e9aa210c928e25fe6e560
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        servertool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
        • Size 4.0MB
        • SHA256 d5b0735bedb3ebc4c369719d3ee97c25064ca32448e8a73467053062ed01cb08
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        tnameserv.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
        • Size 3.9MB
        • SHA256 64a2cccc145a89afae755a2579139fdd2afc19f7e8c86c8f2e89669d42f0fbf3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        unpack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\unpack200.exe
        • Size 3.8MB
        • SHA256 b99fca5bfbdc115552f44a9a99debce14d203431098ac5faea16053945a3f988
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dotnet.exe
        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 45.2MB
        • SHA256 b2169e61b87337bbd4b66f14aed63203c52d2fe92f6e364af5bd18fa1c1a96aa
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 45.1MB
        • SHA256 6a352d4e4b8e86db7e203345e95d1890640fa8a3ac8e5b444cfadfb77fdfe19e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 45.1MB
        • SHA256 8033691ff4aaded46184f13145b9a69fa8bc4e0f191f12172e9553aac85b7045
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/432-25-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download

        memory/1492-0-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download

        memory/1492-3-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download