Overview

overview

8

Static

static

3

2026-08-03...ar.exe

windows10-2004-x64

8

2026-08-03...ar.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    87s
  • max time network
    150s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    04/08/2026, 09:20

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-03_dd6261ef23c27749f4b3d2cf997c3b7c_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
  • Size 35.7MB
  • Sample260804-la8nmastaz
  • SHA256 2bc9a04da0cd320435bb0a0c2d123a419c6b20ce230074762ae75bf0d4fc866b
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
defense_evasiondiscoverypersistenceransomware

Malware Config

Signatures

  • Drops file in Drivers directory 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Sets desktop wallpaper using registry 2 TTPs 1 IoCs
    ransomware
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies Control Panel 2 IoCs
    defense_evasion
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-03_dd6261ef23c27749f4b3d2cf997c3b7c_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-03_dd6261ef23c27749f4b3d2cf997c3b7c_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:4156
  • C:\Users\Admin\AppData\Local\Temp\2026-08-03_dd6261ef23c27749f4b3d2cf997c3b7c_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
    C:\Users\Admin\AppData\Local\Temp/2026-08-03_dd6261ef23c27749f4b3d2cf997c3b7c_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:3760

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        AppVShNotify.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
        • Size 36.0MB
        • SHA256 53da31968791cd0228b18a0d7728a3af20eefdc697237c43f2dc9555f4faec9a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        InspectorOfficeGadget.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
        • Size 56.1MB
        • SHA256 2706b99c3a0fc83d300a4fea4ed8fad2b1aa032adbb3f76ca9081edf478252e6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        IntegratedOffice.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
        • Size 52.5MB
        • SHA256 3ecbff98fd5e06cd3d9b2a7faf149584b5fb5963392912dff78903df894c7b36
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MavInject32.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
        • Size 50.6MB
        • SHA256 4a3903b122d44fea6d9e0982e0185ca26b6ce6ab92a860b6c18f88420fd884b4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appvcleaner.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
        • Size 37.8MB
        • SHA256 e277a671bc9d69066c619ebf87d0684f9fbe74404a096088b933e01646afd8fb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VSTOInstaller.exe
        • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
        • Size 49.1MB
        • SHA256 7f2944f1a7d43e974813819fccb09cb185e8b4b9e6626f1b423dceb044c1bbc9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_pwa_launcher.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 38.4MB
        • SHA256 723e70deb236d63e37d4e4ff2d1da8fe57f91b38d484df6ebaa46e279efc4b4f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevated_tracing_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 36.4MB
        • SHA256 f76470df59dfb8604d31f18b7f9f30ff05c1123cc12c2aafd1da28110d839f81
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 35.8MB
        • SHA256 ba54103de9e7151e5ffbe3141dd73104c13a6bd4da2cbdddb3d1b1d907b79cfd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        os_update_handler.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 35.1MB
        • SHA256 7d0d06f12b241fd726f171d3532c17777515f17971a6d06c49dc9650f1937f20
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 32.7MB
        • SHA256 09eabd758303e40e83d0f568746c1c6aef6568a42656a1477c88d9d7e231bf0f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_proxy.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 33.0MB
        • SHA256 62c03c3b75f0d7610906e1dee19f0b2aff404f33ff016736da3209044a3efe26
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 30.7MB
        • SHA256 3e18a98a8ebae148d10c3b8c145b579ba1d8b843511e35a0f7ed46d1682e3155
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 27.8MB
        • SHA256 1b4373a7cc52944fd27d2fcbdfa963fd9d0f54d99d15e355aac2482204bb2f6d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 28.6MB
        • SHA256 a4f878ee77c1f42a65fea31cae772c063712803c2eb11bf6d1aceca6b7862d92
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 28.2MB
        • SHA256 20755be259fccf9c8891c76ae0bcc3e264074b90b5a8e1a66a6938c93ca4825f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jar.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 27.8MB
        • SHA256 fd75411ade51f56d2f392b3e6d4df853b8949b2fb8b5409bd44d5e4e184c1224
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jarsigner.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        • Size 28.6MB
        • SHA256 1ac2402db6887b81db79d51c7a6aa596e92d69651f018fc548ab2c112ac88a66
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 27.7MB
        • SHA256 a3a26a06ef18904aef2fe5157339ea53e0210d9a2d8b32e135e94537e8db5cd5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
        • Size 27.6MB
        • SHA256 0da293aa61d29d3ef7f8e13aab621ec6e52aa5ace811db916013ed95c1d56951
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javac.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
        • Size 27.9MB
        • SHA256 48b2ed540197c5c83e0f535a7534a2d7360ad026fa9419b595079553ad45cb7c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javadoc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
        • Size 27.3MB
        • SHA256 77412ee39c0a8841a6117896fa57f16944c1260fe9b21ac961ebd5f6e49189b8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
        • Size 27.6MB
        • SHA256 bea72a0e2f37894b7a5bbcae51e1a56522010a90e235b534b386839da6128d56
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javapackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
        • Size 29.1MB
        • SHA256 1e1172ed9a142287e942c5a0638ff6792b427453e6eb0c5cde8078a7a7237edd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaw.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
        • Size 26.8MB
        • SHA256 f76d6aea8f520b988c1e3ca626ca38ab6189b3c37608dc307303b05772dcd8c3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jcmd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
        • Size 26.2MB
        • SHA256 dbefc3a1cc821974e50c3cfda189fa28ff9c89b10e6e943f897a79987302e523
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jconsole.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
        • Size 26.1MB
        • SHA256 b9d446924b6ed612fdde632fa40dff594eed4cc99af51e2158cd4a43caa83d8d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdb.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
        • Size 26.9MB
        • SHA256 5673d45a3fc9dcd5f062188819b012b2049bde24fcdd14ec37839c67a9c7b3e6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdeps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
        • Size 26.1MB
        • SHA256 e2394197d13b2cb89ed881d364b5bda99a24b891b99a9eb52027fd2db8e3426b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jhat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
        • Size 25.8MB
        • SHA256 d69621fcba5bc55f1b9955b3da0e21f714436401cbd439ffae9c5df960a4ab15
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jinfo.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
        • Size 26.5MB
        • SHA256 4a2ca94e2797bf12abbf367c7d161722068bb347fa6988e84d47023e9b5887f3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jjs.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
        • Size 27.2MB
        • SHA256 ad15ff01237f2f1bc8eeb68aa9eb3f5833c9c088f5d79667e7631c1b92be3651
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jmap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
        • Size 25.6MB
        • SHA256 529232df7683a875170a74f90aa26d3de9bd84aa001f460c80376020614dcae2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
        • Size 24.9MB
        • SHA256 81b12d84243cac8e01b14b567939d9dedbc6e039b6a542d36af35898d0b06f3e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jrunscript.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
        • Size 24.8MB
        • SHA256 e46baf24d476f6d40df2528810f7a65fe9cfe7d1a8e8bb6023fc580c2a7fbce1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jsadebugd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
        • Size 24.7MB
        • SHA256 b2aa11b061f5ca931279ea2bd3dae297dafd5fc829717c5ed780964891fbe817
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstack.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
        • Size 24.8MB
        • SHA256 73daecd7f16e7d054cc4438ddbb6fdba8fa4ecf729467af7cf91686c7d097e6a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
        • Size 25.1MB
        • SHA256 5d8867a4e3f203684f958a55d3bd4a9f5f917986c9f535bd1c84414626fc1389
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstatd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
        • Size 23.6MB
        • SHA256 e0088e5ea06596c7ed56c6561a2a18dcdbaa7b9d6a0c4fdcf656ca2496b912aa
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        keytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
        • Size 24.1MB
        • SHA256 700e85880a1bd7f9dd5984ef33836a518f6e7ed221ddad07a9ae383bab15a60a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        kinit.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
        • Size 24.6MB
        • SHA256 78eb1bfe733389c74d11b30e375e606a547b14b197a16713e59ad8aa67967970
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        klist.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
        • Size 25.1MB
        • SHA256 9c25ed72f627f47b4c90a311b335570a1304ccc3a6d9fc245d0a29522fd9a0e4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ktab.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
        • Size 24.1MB
        • SHA256 9999d3dc8bc151f0ab28992f7f3c1c33fb28b8709c678214a2e2e137a4a3eb6d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        orbd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
        • Size 23.7MB
        • SHA256 8e0b1fe815bcdb16c7e02db5d4f220f15ff73a91197fb51d95d0d746cdb7cfcc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
        • Size 23.8MB
        • SHA256 234bf10a48b3d95e07f9f0d6aa76570d375335619c6190884ebef0d547f357c8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmiregistry.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
        • Size 22.8MB
        • SHA256 b7da738960ca3357c9e39923594e57c442baf8f7e3defe738fbe9bbbb871a7e6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        schemagen.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
        • Size 23.8MB
        • SHA256 c623671eb8e61bac36722ca498f24050d2abb29c05233037143a7cc45edad8a6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        serialver.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
        • Size 23.2MB
        • SHA256 1defdd65dc5e8fdbb019282ad8212c0b5d4a7eef5aa1012f678456ab44fcd498
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        servertool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
        • Size 22.6MB
        • SHA256 02db9255857596a36cd12e9d6b0af01d680963cad5e18024634602798ae5470c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        tnameserv.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
        • Size 22.7MB
        • SHA256 7c38f7aa43ca5b9ad8526bc39e6496feec8110ae901ed4852a317c046f374119
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dotnet.exe
        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 46.1MB
        • SHA256 e875b188ae9e5001cd0acf5dcbeb5403d6deaeb272dd0afd5cd6447491c2f913
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 45.8MB
        • SHA256 442ab3e939ec2d2b849c323171291b325c7c5513eab72af59cbd252789398ff2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 45.5MB
        • SHA256 35618dc15a40d77438547126e0b86bd107910ba712c61251b78b0b2497474f41
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 43.1MB
        • SHA256 bfaccc78b0ba2d2524ae4ca78ec228fd654b71a9989e5eeb2c4146c4a493cf89
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/3760-25-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download

        memory/4156-0-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download

        memory/4156-13-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download