Overview

overview

8

Static

static

3

2026-08-04...ar.exe

windows10-2004-x64

8

2026-08-04...ar.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    149s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260513-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    04/08/2026, 22:48

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-04_73703bbf6bfd1b3acb592362bd2c918e_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
  • Size 22.3MB
  • Sample260804-2rlhesscqd
  • SHA256 24de73c0b0d95117c190b282a3e9a016f7727365b5da6b214d6e03ec18fc75ee
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
discoverypersistence

Malware Config

Signatures

  • Drops file in Drivers directory 3 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-04_73703bbf6bfd1b3acb592362bd2c918e_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-04_73703bbf6bfd1b3acb592362bd2c918e_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:940
  • C:\Users\Admin\AppData\Local\Temp\2026-08-04_73703bbf6bfd1b3acb592362bd2c918e_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
    C:\Users\Admin\AppData\Local\Temp/2026-08-04_73703bbf6bfd1b3acb592362bd2c918e_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:4752

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        7zG.exe
        • Path C:\Program Files\7-Zip\7zG.exe
        • Size 23.0MB
        • SHA256 d8c1bac71824ff5098b7f682e0fe00859fd64a31761b63f8ebfafabb4288cd16
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VSTOInstaller.exe
        • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
        • Size 22.4MB
        • SHA256 4bc0577aec43231bdc942dad4a1c57db219db26fcacaeef98a12fc036d0825f8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrmstp.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        • Size 50.6MB
        • SHA256 796c7a27f5b55da58fbf36783b0c30739b387f60e09aff31e4eed7431b40d421
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_pwa_launcher.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 46.3MB
        • SHA256 190dee0f28e90236413971651cd5528d39d0abbe3620bf2eca8a365050deff9f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevated_tracing_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 48.0MB
        • SHA256 e92c1af5a7d4ce780cd527bacd17be503a11a27f13a8a92efcb5a4eabb9f409e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 46.8MB
        • SHA256 4a2417a8e3413096abd662b286c6badcac1126582cea26d4345816beeff25d9b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notification_helper.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 46.2MB
        • SHA256 616c44e1173625436c64fc19bc4d6fa51fabb19a584d7109bca53d8402022c76
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        os_update_handler.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 46.4MB
        • SHA256 d3042ecc2ec35d623cb01c94bc9a5df6d500adbcba94def48549bb15dd4272c7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 47.6MB
        • SHA256 017fbb711b601dfd95aafb1168c6853cf9b28e04ca8046a7b371193d092c2687
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_proxy.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 46.0MB
        • SHA256 f7537392220f1ab58da6b91a1d1e6d94bc14d8c0b4ed47ba9187ef26bc29210b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 44.6MB
        • SHA256 2b45ec8fdbae0141fb16ae60631c9b64e378c8e5915bba817c475a3e3b81152c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 44.6MB
        • SHA256 ef2ebc9c92a26d4088b4320cc68d0e21030784c6827d78f79c56cd3e122d5cd8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 44.6MB
        • SHA256 d2f00b7111fe6873f87f3bb08a75d8668779c7e283d04febac1ca40794c9bfee
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 44.6MB
        • SHA256 4833bf716e355773ed9cc124adc449bc4f976f3dfdbdb7a2cc5e8f79b16853c4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jar.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 44.6MB
        • SHA256 fd25f708c2005a8ab2d9fd6f150b6cf83f307ebff6ca31e8ef420d6f9ce3a52a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 44.6MB
        • SHA256 91b2e241bc36aa4f3df717b14124a9bd39556f612f2a07568d1b066aebc3eeaa
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
        • Size 44.8MB
        • SHA256 5e6d244cdfc6c18b49a406109718ab54791585b6b18e56b667d3a9a9bbfafb6b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javadoc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
        • Size 44.6MB
        • SHA256 aa9a725d71f536e1d60512e9fb975e73e5f0921d63d931546756855859921cc8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javafxpackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
        • Size 44.7MB
        • SHA256 95e1e61aa556cbe10edfb6ce386be026c7b0cc297b16ba2ca17d01bdf74f245f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javah.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
        • Size 44.6MB
        • SHA256 611032ca4d852b387cde3c9d971a9d4af47586103c293ca18af9cfb0943181f0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
        • Size 44.6MB
        • SHA256 fbd5bd509ce7ff4aa6f4eb419c4c6b2a536a02a10c333c259319ae6e950ef6cb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javapackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
        • Size 44.7MB
        • SHA256 0a4b9aecf86b8a912d460a53bd912e40c5777ccab26459e1614d4862c0abd9f2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
        • Size 45.0MB
        • SHA256 64802a71db59fa781721a4a29a027c4701819235df384fba4c4d8a6e644d72ea
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jcmd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
        • Size 44.6MB
        • SHA256 1fbbfa1b0248dbb72b4959d12df41addce31d744221786d164d9058bf750ccff
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jconsole.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
        • Size 44.6MB
        • SHA256 609523cd2fa6f3d3f039957904d471e4262ad2e8c0258dc8dec40adafad7f868
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdb.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
        • Size 44.6MB
        • SHA256 aed4091e8ca73fd88edb599e4b915a588e04b19f337144c6e50da87803951388
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdeps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
        • Size 44.6MB
        • SHA256 9b482fc7aa8fdeb85b15a28638f83d6a4f350ff07a6955f733f29e8d73209c00
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jhat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
        • Size 44.6MB
        • SHA256 3d93f71ac262a34ec0eef450ee82fb33439be4f9a6cb91aede782a86eedb8f88
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jjs.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
        • Size 44.6MB
        • SHA256 7b9ba2a4c81b054e7388b007c2d3885d3abed56ecc87c2d9a26f1f40ccb6a0e6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jmap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
        • Size 44.6MB
        • SHA256 3e9f499c931643497089ab467a79a77ed8577db5f42121d5d6766a36569fd402
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jsadebugd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
        • Size 44.6MB
        • SHA256 f7ca8af2de6e650a2c2873c1d123de931e67280eb6795b592268208cafa59731
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstack.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
        • Size 44.6MB
        • SHA256 0dcfc88dcc1ff4d020a60549042dc0ba8b2196cbf06bbc8bf8a8aff1f458dc94
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
        • Size 44.6MB
        • SHA256 7cfaf26ea7d6bf0e75bd5b7c585ce8e72141bccb3857264ee57381207ba61382
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        klist.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
        • Size 44.6MB
        • SHA256 0d288f17d87ab03bc7372290ad827d805838a538c6d1d9bf156acd8ee930e7d9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ktab.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
        • Size 44.6MB
        • SHA256 6da519084dd9446cefd4aed2799120edf906009e8144113c2921a5e2881bddca
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        native2ascii.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
        • Size 44.6MB
        • SHA256 006ebbb82dccdbbfda8ba8b59970bd89047cc4995be530a0978eafe920b8833a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
        • Size 44.6MB
        • SHA256 b26aac0a715328cbeabd2c378f889677bd5c8e08c2119971996e2df4d0b75e25
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        policytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
        • Size 44.6MB
        • SHA256 c383f898413ee7995feb7b6ef80478704281ff7fb488602df192f52449f4bbc9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmic.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
        • Size 44.6MB
        • SHA256 ddb424543af924113738258121c32f6d50f506804ffbfb756bba843e6b0b89fa
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmid.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
        • Size 43.8MB
        • SHA256 56acab414359348ec9443b917ab8c30db33bb44d5322d2175f7b00a824d26899
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmiregistry.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
        • Size 41.4MB
        • SHA256 82bf85a1fe62e3e83de27e7281c34bf9d482fbec4aae8b43230cd36a19c26c87
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        schemagen.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
        • Size 41.4MB
        • SHA256 8e37269d7ce707137eda862c4d96b7b83aabc4070deffb2ee9fc7065f03fb9f4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        serialver.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
        • Size 24.8MB
        • SHA256 889cc0fbcdcc5565fdf96a0ecaaf22d9482019b19e739f9cfcf16d9e477dfd8c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        tnameserv.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
        • Size 20.9MB
        • SHA256 741b57e03729b8f2f0da4799eed9bf88b038a829d92ddbb3628e8d69405ded74
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        unpack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\unpack200.exe
        • Size 7.8MB
        • SHA256 3996a7c5b353c78cf07e6d19b152ec839c09af91df2ca36e3bb5bba2d60b5f32
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        wsgen.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
        • Size 5.8MB
        • SHA256 53a3e742d00a1d4abab7a9e74ec6ab654527b077bb761729d933aef2df2506f3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        wsimport.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
        • Size 5.0MB
        • SHA256 f5b72741a72e09618f9efa105d604ba78fd5d510d33176e748b77f8353336e7c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        xjc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
        • Size 5.1MB
        • SHA256 0e8bda9102991ff7bd68cb812fce67119ac538136d13aa0f3cc506a6516ba75e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dotnet.exe
        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 44.7MB
        • SHA256 a608e1143c531426e14e93e7572bf370ddd8e2a88d1bae072c65f615e3f72b6c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 44.6MB
        • SHA256 b144a902a5f9a76b1b6bf31d70d01c2fdc5d3362c6714a3896b741a2743ce6e6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 44.6MB
        • SHA256 a3f09169af14480358d4cad120d02e7cc215cebd27000f6598e7a2d1225c3b11
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        spo0lve.exe
        • Path C:\windows\SysWOW64\drivers\spo0lve.exe
        • Size 22.3MB
        • SHA256 24de73c0b0d95117c190b282a3e9a016f7727365b5da6b214d6e03ec18fc75ee
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/940-0-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download

        memory/940-5-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download

        memory/4752-2-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download

        memory/4752-6-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download