Overview

overview

8

Static

static

3

2026-08-02...ar.exe

windows10-2004-x64

8

2026-08-02...ar.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    149s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    02/08/2026, 22:08

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-02_0bbd43f135c4a7acd3de5db387536ddf_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_stealc_vidar.exe
  • Size 11.3MB
  • Sample260802-12el7asgpf
  • SHA256 87a1080e89d2364c734f0f99960ff1d40f9884ba071a6c08c72a8344daa204e3
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
defense_evasiondiscoverypersistenceransomware

Malware Config

Signatures

  • Drops file in Drivers directory 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Sets desktop wallpaper using registry 2 TTPs 2 IoCs
    ransomware
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies Control Panel 4 IoCs
    defense_evasion
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-02_0bbd43f135c4a7acd3de5db387536ddf_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_stealc_vidar.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-02_0bbd43f135c4a7acd3de5db387536ddf_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_stealc_vidar.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:5828
  • C:\Users\Admin\AppData\Local\Temp\2026-08-02_0bbd43f135c4a7acd3de5db387536ddf_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_stealc_vidar.exe
    C:\Users\Admin\AppData\Local\Temp/2026-08-02_0bbd43f135c4a7acd3de5db387536ddf_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_stealc_vidar.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:4892

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        Uninstall.exe
        • Path C:\Program Files\7-Zip\Uninstall.exe
        • Size 11.3MB
        • SHA256 87a1080e89d2364c734f0f99960ff1d40f9884ba071a6c08c72a8344daa204e3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        AppVShNotify.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
        • Size 22.8MB
        • SHA256 c007b2104a7f1b4137241076b8fc824d4d96fad54f99a4ca74dd784d1ffd7e52
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        InspectorOfficeGadget.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
        • Size 22.6MB
        • SHA256 ed355145a3fa0927131b2b901034ff8efe9a1411bf203d5cea2f1b260479f1af
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MavInject32.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
        • Size 22.9MB
        • SHA256 cb898e136f87c81075347a918098fdf74d17c13c5a2e63f755a35c847dbcd272
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        OfficeC2RClient.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
        • Size 46.0MB
        • SHA256 e6149cf5fb6e2007fab2908e40cf1952266399d7708d69bbdb50cc808afc0071
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appvcleaner.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
        • Size 24.7MB
        • SHA256 b896554c57be49c73b875ad143b71171099fc1dc7e95ba7ec8e75f9268e33228
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrmstp.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        • Size 28.6MB
        • SHA256 6244954d67a2385e0124732304cc3eb52b4dcabb949024d2165873a85e608f8a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notification_helper.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 24.2MB
        • SHA256 2eed9a807b414ccf082c4f13029830c6fdeff8075c54108d33f71ee614978b4c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 25.6MB
        • SHA256 952d251174752c23100da9cff21d4f6f55f0955d658fafb74d68411cfa70a30d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_proxy.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 24.0MB
        • SHA256 e8468fc092ccf2392d14b1606486696ae779de51e3431ae1559f29a313babb62
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 22.6MB
        • SHA256 ac6ec369aa95152fd5ad88dc64a1b2c5db31fafcbaf71ba50596c14d4e1a2eaf
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 22.6MB
        • SHA256 3a8be09237559f6784cc87ac108fa9dc867283ef31f2382d6596a578f9d2c26d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 22.6MB
        • SHA256 758243e1b29a6de5902ece59476b464146410b88eac39d4924809a8df0d6347f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jar.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 22.6MB
        • SHA256 5086725f266b717ec54b71d6f96373f8bb1c5a2eb5e123ad70476a23c82a7ea1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 22.6MB
        • SHA256 3095683819f1af3c7a416d80eade9507909335772e753d81bcd35762c5eb6d59
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
        • Size 22.8MB
        • SHA256 826fcd4f1d4c10c55419083fdff9c999be109cb596379395b351b1bad60e0ded
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javac.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
        • Size 22.6MB
        • SHA256 5b9bd6838ffd4f385ca0c0fef59d0fc7f92b72c64ce97d936f780ca8056897d2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javadoc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
        • Size 22.6MB
        • SHA256 75a703c1bbf62d996898ab96ecb3ddc0c00303783691a43685af90e1c2ea4c8d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javafxpackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
        • Size 22.7MB
        • SHA256 ce5d08dc8f93b9f92f878baa0e46df44e6fe3845c7d6129cc2df8a84e266a1fa
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javah.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
        • Size 22.6MB
        • SHA256 b86dd6bdb93dbdb5602a7928f37a94b86a8399aa6f292256cb00654fc368fec9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
        • Size 22.6MB
        • SHA256 5d3757d4d36cdca356a88904f09d8e3a7d2e5d3ed8b7ab2183e5855e63926b8a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javapackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
        • Size 22.7MB
        • SHA256 dd43e894f52c4f94415f161ee5887584949b941515a9a6b5ad1b98c7090914b9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaw.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
        • Size 22.8MB
        • SHA256 f85084b3c860188df1a9da651b0601a007f7e2c32d63b1552a847f827cc0fe84
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
        • Size 23.0MB
        • SHA256 aa32ad919a4ec90cd0e1e2980e5670c0bbc406257e0928030eb60a6f3dcebee5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jcmd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
        • Size 22.6MB
        • SHA256 c214e94f7667a56e969694c3346dbe5c3688beb02ef36a5757c85706a1d1ac8d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jconsole.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
        • Size 22.6MB
        • SHA256 cc470630a47d7d702c1382b11766c3ef1700dbb58aa7ad9ee922a2d5cc509fe4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdb.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
        • Size 22.6MB
        • SHA256 01e8e120d6c052110844127e0179c6fdd54df8620aaacc7715174b659bd1d2a1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdeps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
        • Size 22.6MB
        • SHA256 3e7b02a53bbb70c35c8323187c33b9eec469a23873bdb5086679d745cc85c9e2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jhat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
        • Size 22.6MB
        • SHA256 37b18b2f5a68d083bbe00be8af655fe3f1b991331b7f2d8f28f69102f8a9461c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jinfo.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
        • Size 22.6MB
        • SHA256 fc76ec1f230e0f1a0f76d0b5f73d29b44fd078f6b104e52f01e7b3c74c61daf4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jjs.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
        • Size 22.6MB
        • SHA256 0a054bf02f48d51a4662e1b16394492b12d07a646912f0a76a6e18c0b8680658
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jmap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
        • Size 22.6MB
        • SHA256 06a489fd4613ecbc6087efda035559a6c551bf94d330f287e0ff709511b43526
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
        • Size 22.6MB
        • SHA256 0301cae7967a6914efe9db8b767f9b48bb29bc3f58a49c2366adf93ed3e3ebf4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jrunscript.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
        • Size 22.6MB
        • SHA256 814ab25628b49104b9535cb51e9ffd0de6fcc5b929d16028d19a3f5af22f0460
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jsadebugd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
        • Size 22.6MB
        • SHA256 789e22b8febe6067ac9eb6392d9975996d30afd8ae610e8fd29498a24a4ddf0a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstack.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
        • Size 22.6MB
        • SHA256 5da269283f4f36fd65c3961e100678bad4aa865d41fc25a21f6c7e4776d39930
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        keytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
        • Size 22.6MB
        • SHA256 6f46fb10cafc8753371d9e723a15283df352382cf1e4d65f6c5d7fafee843302
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        klist.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
        • Size 22.6MB
        • SHA256 1adb7ba8bc78171ed607c066f0c72cc8475b230ad0ff02bf474a90c203d09a7b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ktab.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
        • Size 22.6MB
        • SHA256 0c77d874975ebc856a0ab71a45eeb3258c23c3be30f97c0ccb91ffe3d50e6936
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        native2ascii.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
        • Size 22.6MB
        • SHA256 bc7e0e57e6d82a7bc53728b4a9fea9b531c73ca351ae3163cedddc9c769222d0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
        • Size 22.6MB
        • SHA256 d434b72c23c6e064122256862f12d64e95db767729fae4e4aa034990d95b72df
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        policytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
        • Size 22.6MB
        • SHA256 21e9c3bb4cd16cb060d9fc5ff11a16915a9f61124e79d3d7da02041e16c74bd5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmic.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
        • Size 22.6MB
        • SHA256 f88da7e36c04683f59a30004dd83eb6ed7110c80e10fa0ee34572abd359ce9b6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmid.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
        • Size 22.6MB
        • SHA256 d98eb9b70eb42eb5ae4e7c66fcd03b833a612f533ef6889d41a8dcd2ef5accd3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmiregistry.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
        • Size 22.6MB
        • SHA256 da6a427f46f4908c06ecf62554ade3412a518aa45dfc482c57443d1cf866a2dc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        schemagen.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
        • Size 22.6MB
        • SHA256 307d894d0e738ed5e20f55f4bff3f4b496902cbdd1ae8c948b0f733e486307cd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        serialver.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
        • Size 22.6MB
        • SHA256 2d8dba73dc879ef8101595a712b1911af9abef31f7eedf013eb8e534b5b18a23
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        servertool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
        • Size 22.6MB
        • SHA256 002af1e02977d6875e4f958f5ac16e2cbff528ef5846f8cb4fe3184d559c38e5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dotnet.exe
        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 22.7MB
        • SHA256 4949aef1ae534d9b2f01c6e72e91b6ab54ccfc0b47ee9c5ee096aab1cb49a030
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/4892-5-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download

        memory/5828-0-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download

        memory/5828-1-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download