Overview

overview

8

Static

static

3

2026-08-04...ar.exe

windows10-2004-x64

8

2026-08-04...ar.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    31s
  • max time network
    154s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    04/08/2026, 22:48

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-04_73703bbf6bfd1b3acb592362bd2c918e_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
  • Size 22.3MB
  • Sample260804-2rlhesscqd
  • SHA256 24de73c0b0d95117c190b282a3e9a016f7727365b5da6b214d6e03ec18fc75ee
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
discoverypersistence

Malware Config

Signatures

  • Drops file in Drivers directory 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-04_73703bbf6bfd1b3acb592362bd2c918e_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-04_73703bbf6bfd1b3acb592362bd2c918e_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:4556
  • C:\Users\Admin\AppData\Local\Temp\2026-08-04_73703bbf6bfd1b3acb592362bd2c918e_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
    C:\Users\Admin\AppData\Local\Temp/2026-08-04_73703bbf6bfd1b3acb592362bd2c918e_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:1872

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        AppVShNotify.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
        • Size 44.8MB
        • SHA256 e33323c05a236996dd1f837a20f59c1732b93db2719aaf22fc6251bd632752d6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        InspectorOfficeGadget.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
        • Size 44.6MB
        • SHA256 f2a4ab8032c7b68bc0f089fffada8643d31d3ebc34e5447c9beb8e601b39dde7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        IntegratedOffice.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
        • Size 48.7MB
        • SHA256 487da7aa840e01739460a3e08a93ec4c9a84c93debb0f726538a94b932353dea
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MavInject32.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
        • Size 22.6MB
        • SHA256 a7517ef57b5759ec832aef8e0dd88617c997ddcf0c49eba919414d726678655b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        OfficeC2RClient.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
        • Size 52.1MB
        • SHA256 bf6ca4b2a9ae97cf09e030af16230c19972f154ef7868d3ddf7a93f55b87b602
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appvcleaner.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
        • Size 24.4MB
        • SHA256 96a86e38a07f9619b819b325f87efa73b7594313594fa6c35615824b024bee93
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VSTOInstaller.exe
        • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
        • Size 44.7MB
        • SHA256 1eef12aa16f6ddf61fdd52e7385a371a002677e75316725b7ac6f255f433fcb2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        setup.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
        • Size 40.5MB
        • SHA256 107be204d7f849bf9104395a94c8ca559421453328c2879469132f66c6577018
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_pwa_launcher.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 41.3MB
        • SHA256 2cc93b73429d46846b4f71fac0b3f8549b65ddc2e2f37f45c80b51882d32bae3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevated_tracing_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 40.2MB
        • SHA256 497a2d838b9a8f750eda10bd67e2e63c9ae4a40ba643a11764b52de55587eedd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 37.9MB
        • SHA256 195b8cb33dc203ca381148046516c6cc1f1f88a149bc807905f9e9a99fd43eef
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        os_update_handler.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 39.3MB
        • SHA256 ad5eae566c78744ee3e4c276ca7a30205709c533f4f9eba7502582c6c65ad4ec
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_proxy.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 38.1MB
        • SHA256 0089fa75c017e5e912ee6ef3ffe1fa099bb6bf60ccb9c317d8e004d11dd0ae8a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 37.8MB
        • SHA256 f366ee82536e0fb6bf70b12b895c3b4b3d74b6c94ce357bd5dfb40382494e809
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 32.3MB
        • SHA256 e1ef4d28110ec680a1f5e45721b0dfa3b105b7b343160fc40e026d4bf5cbf57b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 30.2MB
        • SHA256 8ab86f5dcf439451bcac752330749b58cf54cc8f706a1f90191b7af50eed4a07
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 33.3MB
        • SHA256 70b65888d28200ec04f19c7a8f6c9a57996e1ca9646c720d0e42c18199db6847
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jar.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 30.6MB
        • SHA256 5d9872d6b6e967595c3b515281932410666afb5a4c3baf3d9513b9338e5a4a24
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jarsigner.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        • Size 37.2MB
        • SHA256 31039cf7c1226f15d86ef0d34017d6756c2e2efa5ebd06c52ceaef9381fd5cfe
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 37.0MB
        • SHA256 a07f189c096f32fc567201bc8642d65a8dd2ef5526d59565f45a432ea02cce6b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
        • Size 36.9MB
        • SHA256 39d40fbb912efce29827b7002405307748b756240761c5e21dd3d655a5d2aafd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javac.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
        • Size 34.0MB
        • SHA256 9afdbbca0cac51a1cf5d5a0fa0e2ee48e70dfa06b09cf06be497fffd9148059b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javadoc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
        • Size 36.2MB
        • SHA256 6fd4389c2a01bd806a6974734d25b182f5e3c0fac5ad708190f17f697c1ca708
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javafxpackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
        • Size 35.2MB
        • SHA256 728f644ca277d14998feef5f098528fd55fa4fd4e81edd58b1f079ecbcc905b6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javah.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
        • Size 31.1MB
        • SHA256 293106e19fdcee4be1e6891b1f986bdf3ef2516c58c698ad426398385394b4e9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
        • Size 26.6MB
        • SHA256 68775dff3abaa36fb70259d7daa7c7e93c36173100605af418f1f3bc452c477a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javapackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
        • Size 30.4MB
        • SHA256 dde6f4b4d6ab38cb08430d25231f7e1fafa739fb777633fbf00442521cb791db
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
        • Size 29.9MB
        • SHA256 be6a9924f4741e0804531775dd4a0300d7ed7836f2f05866dfe9e865d65577a9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jcmd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
        • Size 31.1MB
        • SHA256 a94602acf566e75ed5d48d7a393f6c8e79270d2bf1ca7cddab850ca5d85932b5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdb.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
        • Size 33.5MB
        • SHA256 6d394236f7dc43bacb6560f1832b9ec54ff7ec3fa719f601b0201c0a4b353795
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdeps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
        • Size 30.8MB
        • SHA256 6a14ee58a64c1044578a5f299a0a39d4cf8fb5ae46b0e62c411e8d38dd6bf4e6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jhat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
        • Size 29.7MB
        • SHA256 ad90e86a3d5194d112de542ae9163c8d44f60cf9bec4b55f09259f5d1e8dad76
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jinfo.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
        • Size 33.2MB
        • SHA256 25ad8e0311bd55b56dbfdcdae4a35531ff3c306b1ec3aa03ebe2e266ad5f7a6d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jjs.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
        • Size 29.3MB
        • SHA256 6cfbbb172e93f3c7110b2a4a01156b969eac745b7e114a465542d8d1ab00a6c8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jmap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
        • Size 33.0MB
        • SHA256 99cb92dcdbbd673482e86d208b28b7eed6cce86e66ebe58d216d9394c56999b5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
        • Size 32.8MB
        • SHA256 764e843b91ede940505c6c217458fe5d4df93feb8104d23e9dfa351340b8756a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jrunscript.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
        • Size 32.6MB
        • SHA256 f49f184ac8d768c242c1cf3eea5715f6b2e8e7c7a7f28b3d1aecc2e1cdf3d945
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jsadebugd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
        • Size 29.0MB
        • SHA256 ecd1a47c5594e1ac86e7b9ad3795b10aa9602ffcc12f331805ed4b29ccb55a49
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
        • Size 32.5MB
        • SHA256 cf660b897c0c61948b425f3116e0c53100827cf48330e0b1b54a73614a3e10eb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstatd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
        • Size 28.4MB
        • SHA256 8f56a67c597c25807d7e49bb8f34b99bbba66c6b70e1d2af8a328fb857d263e8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        keytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
        • Size 32.2MB
        • SHA256 b64cb1f4b6b71cb12e090ad38cf398e7b4e4fa5d689edccfbd1703d36183604a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        kinit.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
        • Size 32.2MB
        • SHA256 bfc0116b8e931efe593652cac11d2b1812702905ad79cf9c93e07bc9cd5bc874
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        klist.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
        • Size 28.4MB
        • SHA256 77ccd725f4696dad224152c836f9b629900c7ebb5bb16a5134c9213d8cc01d1b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ktab.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
        • Size 32.1MB
        • SHA256 a8f4d8bc97a6973d122843371ec7b6a3cae869f3b2cf13d69623041d22813663
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        native2ascii.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
        • Size 25.5MB
        • SHA256 93aec32de1ff0b3990639da849372aca12d3402cad2ec10f490a4fef5aea4f6c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        orbd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
        • Size 28.0MB
        • SHA256 92e67498827b0b5f0daf1672658b2198d96d4037127d274a02a2c5b80690e449
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
        • Size 25.2MB
        • SHA256 cb304958e065a261f390257546f17d4839cde13139a0ffac39bc1a69c4882a90
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        policytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
        • Size 31.8MB
        • SHA256 157c066d33b4f74db2b25e5ffddc038551de61e1eebe0fbe864c4e4f26ae871d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmic.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
        • Size 30.7MB
        • SHA256 f190547186bc0fe551592aa764a0a0d4e43b027eeb0fbe12320b1414f4236861
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmid.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
        • Size 28.9MB
        • SHA256 37878e916cc2bc0f5e8b225642fd0d43ed474b1f1bc8c62e1197dbe85fae27a1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmiregistry.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
        • Size 31.6MB
        • SHA256 53ba098a5ac2e35ceec48a1c9c0bb767a157e06f18133d5d2e668e37ef3b64ce
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        schemagen.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
        • Size 24.9MB
        • SHA256 2ccc5f167f776dfadab46d8e4e9d3a34af4e7cc303f40686e3ab8a173fa57228
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        serialver.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
        • Size 27.4MB
        • SHA256 8f4a4cec9c918b186cb8bfa005e91d4c9bfd0d9eca131ea1e2b088c620f03976
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        servertool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
        • Size 31.3MB
        • SHA256 1ec6356b7753b255cf344af69e7982676c32050f0caf3f976833d55c2451c17b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dotnet.exe
        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 44.7MB
        • SHA256 a608e1143c531426e14e93e7572bf370ddd8e2a88d1bae072c65f615e3f72b6c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 44.6MB
        • SHA256 f39abf60dff6d652ec71c85226882acb69f7ae01532b95a5ef92a674682caccf
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 44.4MB
        • SHA256 85b5de2ceeb2f83722d16446981910916ff4d2f6f1a95e8c74ef37579e82bd2f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 44.6MB
        • SHA256 a3f09169af14480358d4cad120d02e7cc215cebd27000f6598e7a2d1225c3b11
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/1872-22-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download

        memory/4556-0-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download

        memory/4556-5-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download