Overview

overview

8

Static

static

3

2026-08-01...ar.exe

windows10-2004-x64

8

2026-08-01...ar.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    51s
  • max time network
    135s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    01/08/2026, 03:01

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-01_88adac634b59bcbbf6437088609903e0_amadey_elex_emotet_glassworm_icedid_njrat_remcos_vidar.exe
  • Size 26.3MB
  • Sample260801-dh2laavvhy
  • SHA256 09eb3f37bdf8bca4afeffa087e185e666a6118aa68b30a26c72828966ca99f52
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
discoverypersistence

Malware Config

Signatures

  • Drops file in Drivers directory 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-01_88adac634b59bcbbf6437088609903e0_amadey_elex_emotet_glassworm_icedid_njrat_remcos_vidar.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-01_88adac634b59bcbbf6437088609903e0_amadey_elex_emotet_glassworm_icedid_njrat_remcos_vidar.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:4652
  • C:\Users\Admin\AppData\Local\Temp\2026-08-01_88adac634b59bcbbf6437088609903e0_amadey_elex_emotet_glassworm_icedid_njrat_remcos_vidar.exe
    C:\Users\Admin\AppData\Local\Temp/2026-08-01_88adac634b59bcbbf6437088609903e0_amadey_elex_emotet_glassworm_icedid_njrat_remcos_vidar.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:2132

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        InspectorOfficeGadget.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
        • Size 26.3MB
        • SHA256 87fc478f9ce5eb99bbdc3c5644e6927ed12b00327f8f60936deaf0ff537243f5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        IntegratedOffice.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
        • Size 56.7MB
        • SHA256 6a30bcbe4e811866c6bac7ed497fc93f541c4646410054c87bea7876de253bb0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MavInject32.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
        • Size 53.0MB
        • SHA256 fc2c4ed9dc106e8fc77d6fa0357d0f2f50a711bbddb75f0876b113c5544bbd46
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        OfficeC2RClient.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
        • Size 61.6MB
        • SHA256 bb128aa6ac07f06d4f224bb010c1afd5bb3dd769bbc97e101a6a27ef7f637b83
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appvcleaner.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
        • Size 28.4MB
        • SHA256 1634d8439c7a1575d6db24e2ddb296e831a37fde0c8e84741af91d88d84f488f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VSTOInstaller.exe
        • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
        • Size 52.7MB
        • SHA256 02041e2ff0c1e98c19be5f79872d7e808f1965179113f07302d7e59ab98e14b1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        setup.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
        • Size 53.6MB
        • SHA256 049fbc965495d6908e57785d24427a3a1975059a479a59ca69fbc444f84c5130
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_pwa_launcher.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 54.3MB
        • SHA256 854e70d46e8778cf4f7013f301830c69449329f11518d4f778ff9d729f75f17a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevated_tracing_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 54.8MB
        • SHA256 0a895d11e80bed4ca5d3e2bee5bd5b3b66b7b124c1e3ff1576f19106152683b5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notification_helper.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 53.4MB
        • SHA256 6c79e6feb11e08089e99283928e134f6028ea09a5bb727d5796f6fd80a8eed27
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 55.1MB
        • SHA256 30d43dd0e373d91786817c901134dcc937cfe2d94878a759b4c7b3df3b22629f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_proxy.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 50.1MB
        • SHA256 0be588cdd0ec9afdd208acc9c429aa8187c4824b490a35a186e03b6fbf858e7a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 49.7MB
        • SHA256 988bbfd9f8a152a026968662ef307ddcaa2ac070bfbf401de600e1d0fc6db5f7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 44.8MB
        • SHA256 95d7936fadcf3fe492be657a90365fc31b72eb3607e14db8e444ebe173090141
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 43.2MB
        • SHA256 0ba63d469167baf7412db97a341363b8e154a73d73c8d93269d28474751684c5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 43.9MB
        • SHA256 5ae9a918d2d1bc53c7449d0f5c5c712cda3975167e6d121dd127f55c758399c8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jar.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 40.0MB
        • SHA256 67ebefb048570f9e839693b5e95e460f7f3d87ceb639b9588e7b7d94e6d710fa
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jarsigner.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        • Size 42.4MB
        • SHA256 c713e08fd661ac4f1f4ab381e9499df4b6542acb12b9731c31fda9911cde6491
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 42.0MB
        • SHA256 3cc0c7271e5a3d08257f08b5892e37c00533e45b9c97b9d8b85220804fc2e821
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
        • Size 42.9MB
        • SHA256 f62ea1a0793d25f98846bc4bc8029fda57f9a7a1a81f894f2fb6cd98732f1bb6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javac.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
        • Size 42.4MB
        • SHA256 759180eba68c7f23817b3f596616e62b3a8e96b39070fd2c35a575e704d8b2d0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javadoc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
        • Size 41.3MB
        • SHA256 d1b0df58c119871a6c61e4d175b9bfbfb3dfc07fe0ce214e50cbbbee05140247
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javafxpackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
        • Size 320KB
        • SHA256 363d8bcebbc5b12363d0170b74c75e244be34429994cda946f54b9498c281b27
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
        • Size 39.8MB
        • SHA256 c8e278040176cbd1188aa27f2ada9ecfb00a43fc314a2fca5db124545f4a3821
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javapackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
        • Size 37.8MB
        • SHA256 24949ed46e5904cc77c61a7220d39b04c88bee6a5696f95efa489d6b1028ed7e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
        • Size 37.6MB
        • SHA256 2ecee414d6ef2d35bbe36732b48098764202ae517df0322b1a559359539ef03f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jcmd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
        • Size 36.7MB
        • SHA256 1d85be191d3c776578343b22e740dbd60411c57b1c1fc062a90efeb39e6fa31d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jconsole.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
        • Size 37.9MB
        • SHA256 8e5d5dc0fedc6457107a3532d6339e16b0dac4e1dea80c7907080a910c4e7f5b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdb.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
        • Size 36.5MB
        • SHA256 aa96a7e988c6dc4c759a4cec699639695243c82f985fc77976c77cec7c050f8b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdeps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
        • Size 38.0MB
        • SHA256 15889b36876d3a442ef28e8da1e94e06c4de41047730d798e84378ca0f3d27aa
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jhat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
        • Size 36.4MB
        • SHA256 ff0a4dbf80f8e0ee2027e6a32339e0e5d391a428fda562293b05d71b1261df2e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jinfo.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
        • Size 34.5MB
        • SHA256 9ff4b40c52996dc3f9cbef2a00c992d5e7314f97332748751e96db49c65cfca3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstack.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
        • Size 35.8MB
        • SHA256 0e12f1f7799c7d4f5ba34ee1bbf5959ed45c1d842914947bbc2f6c23f882d40c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
        • Size 36.0MB
        • SHA256 8c10ad0060b762a4b7ccd6fadae845981b28b250f3aab186efeddeb68ae115a5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstatd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
        • Size 35.8MB
        • SHA256 bace9ee832de8f6ac34e6844d0aaa22761d1a304b4e9c35dc63fb6db8220de61
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        kinit.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
        • Size 35.4MB
        • SHA256 c57ca61256426a9e849c7b6d4f283aba77f644a431de74e55008b30bbc69264e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ktab.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
        • Size 35.3MB
        • SHA256 d63cf80e6cdc3e1f93b111d72e597ed0277a7e8695baa8ae7fd80ba4520d94a3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        native2ascii.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
        • Size 34.0MB
        • SHA256 51fea001dffef11cb278fd3aea902605e8438550d494c045999b75be8f574f54
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        policytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
        • Size 34.9MB
        • SHA256 7cea8a2b9a323b3147489b18bb78a931ecfaa73e2afd4f7694da3216e8039ba8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmic.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
        • Size 34.7MB
        • SHA256 6ab5c35540e7850248f5c9ce49357355d84adb41dc4b437221b26c8f4622858a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmiregistry.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
        • Size 33.3MB
        • SHA256 f5b1efb09496febcba8b7ed5d45177fe0c20bb6a8c7a95ca71b391fd36b43aef
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        schemagen.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
        • Size 33.4MB
        • SHA256 453e65afd20caf024267cbd5119a68961e13632750f36873e70a08c5dba7d062
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        serialver.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
        • Size 32.0MB
        • SHA256 3ced95b7f6f780af01191c68722b045931caa791ed2631856ac991089deae46b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        servertool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
        • Size 31.8MB
        • SHA256 e195af5fcab87a3f8a785aa58e669456aec33ebbcd1b1166e501fb1e04babcff
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        tnameserv.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
        • Size 31.2MB
        • SHA256 4444f8495106d3c3f204862bd677fab92e4ed5b1c091b6d6f9e69c806bf63b42
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        unpack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\unpack200.exe
        • Size 31.0MB
        • SHA256 3cc2345a2ea0681ffa388d5f2e101b8aded0f5929bac637486e4e702152af66e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dotnet.exe
        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 52.7MB
        • SHA256 09a5fba9bf4556626896efbeec4e6ca1d3de6bff6e91871992f02b08b6ae7290
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 52.7MB
        • SHA256 51072ecfcba535d60090a4b73b2b1357ae0e87e8545fde87c3ad0249b859c733
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 52.7MB
        • SHA256 24535cd7745c65b23b51459462fb2a5f8248b64d636492282eef173ff4316e08
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 52.7MB
        • SHA256 ad400268ab0f47f868e577f181408036a6970a6c7e0e71a33301ad932652afba
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download