Overview

overview

8

Static

static

3

2026-08-03...ar.exe

windows10-2004-x64

8

2026-08-03...ar.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    149s
  • max time network
    135s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    04/08/2026, 13:11

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-03_07e96b847d4cbad18a10b8cbe12c7244_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_stealc_vidar.exe
  • Size 15.2MB
  • Sample260804-qe4mpa1eqb
  • SHA256 0f39870760c492ddfe515ceb711b1af24158069a5ea5f81eb9115e5faf900429
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
defense_evasiondiscoverypersistenceransomware

Malware Config

Signatures

  • Drops file in Drivers directory 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Sets desktop wallpaper using registry 2 TTPs 2 IoCs
    ransomware
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies Control Panel 4 IoCs
    defense_evasion
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-03_07e96b847d4cbad18a10b8cbe12c7244_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_stealc_vidar.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-03_07e96b847d4cbad18a10b8cbe12c7244_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_stealc_vidar.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:4660
  • C:\Users\Admin\AppData\Local\Temp\2026-08-03_07e96b847d4cbad18a10b8cbe12c7244_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_stealc_vidar.exe
    C:\Users\Admin\AppData\Local\Temp/2026-08-03_07e96b847d4cbad18a10b8cbe12c7244_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_stealc_vidar.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:2840

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        7z.exe
        • Path C:\Program Files\7-Zip\7z.exe
        • Size 15.8MB
        • SHA256 4e748276e3930998ecad103d9ec55f06f2ad8f4cd5b0bba7188f4c8edeca59cd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        7zG.exe
        • Path C:\Program Files\7-Zip\7zG.exe
        • Size 15.9MB
        • SHA256 47f45fe1496fb4a63b0318cdabfb3316fd08b70def41a79187d30dee79a2fdbb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Uninstall.exe
        • Path C:\Program Files\7-Zip\Uninstall.exe
        • Size 15.2MB
        • SHA256 9efbfe5aa1ef3e7c96e0571952d961b096e58f17e88d38918a94d2450597b32c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ApproveExpand.asp
        • Path C:\Program Files\ApproveExpand.asp
        • Size 31.2MB
        • SHA256 1368f057a2261bc395ce80db8a700c8756688050f56e9ab8b453f2c466a0f871
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        AppVShNotify.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
        • Size 15.5MB
        • SHA256 364c7d7e57508545237acc893e0a3c32252e9de4a0f30ab74f78cd221992c49d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        InspectorOfficeGadget.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
        • Size 30.5MB
        • SHA256 cb0c20a90a65904a0d6e87d12881999a9a9cef282a9c7fb387aeb40865911799
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        OfficeC2RClient.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
        • Size 53.9MB
        • SHA256 519a8299e1e186936c6c9b42983a395403cdf827f0f84745ec8b068a3aa33d6b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appvcleaner.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
        • Size 32.6MB
        • SHA256 af907c52e640ab4329d0c9ed76ea3c8ea03a83337429d893c48f080498165aa2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrmstp.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        • Size 36.5MB
        • SHA256 458f5f8c3757775786b211f1f7b488cb86d7aebdc54c362630c1a3dc987d3b91
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_pwa_launcher.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 32.2MB
        • SHA256 2176880fd5eb583ca6dedc6e25ced687211a15d3a8573273dfc2da0a3bed70e3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevated_tracing_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 33.9MB
        • SHA256 1a12dbc8fc2ec0b9803fd1f065c96150734cd7dc46898fb90431dbb4d2b9fa5d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 32.7MB
        • SHA256 995367454fcf5736501c75182c124f688f0d374bb3e720d0d7c6e669276f1fe9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notification_helper.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 32.1MB
        • SHA256 3a4668d84cd245407c8820e20444ad587eb0ed829822f4f1b3ad852fcb675498
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        os_update_handler.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 32.3MB
        • SHA256 150b667f23a5928bf45f022a23f49150231caad2a030e7ed105b4f7e0a08ff8e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 33.5MB
        • SHA256 cdeabb41577b8e56ba85f89fe08c83a4af3a3af6514b6d059cb7b0a89552951e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_proxy.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 31.9MB
        • SHA256 8141bb22f87bfd7ccdb8c89537766e8ab5cca6c444ae5a5e8187f36d79134810
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 30.5MB
        • SHA256 c4f86357eb6f5eb4e7a10a2ce5a689ebabc052bcaec4d67b541915e13c872ae3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 30.5MB
        • SHA256 d8a57a2885be62517088a98f46317667b846a77157d29bb7991929751fafb99f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 30.5MB
        • SHA256 b235df4f6eb06b49fdd06c9d77081deb446c9e0a911c312dfe8022419622f2fa
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 30.5MB
        • SHA256 2981c996655d52ae7324595423d80e0790c8fe6c1f2e2290bccb559d6be204ce
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jar.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 30.5MB
        • SHA256 836e39456aa19ce459b829de16f7b1bed0372df61ceacf243489b409e6fa16ce
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jarsigner.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        • Size 30.5MB
        • SHA256 14004d80e902d275c199e37083d4562412aed9a98ed6a5b5db94bacb10d49987
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 30.5MB
        • SHA256 52232c43516c34f0c0f59dcfa1f38b074e2e46d59719a07209e7598106d74f08
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
        • Size 30.7MB
        • SHA256 8ce54db26f0891739b6f2df6d6d9977e6b334ca4949d0f157e7e9b373aad7921
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javac.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
        • Size 30.5MB
        • SHA256 68b0f38553d1c628b1d0fad01b1b36546107f28e3e54bbba74fce8376d633903
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javadoc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
        • Size 30.5MB
        • SHA256 779fa00db5b327d86585cec4183f9109e40e84f60574abba82c84d0860d876b8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javafxpackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
        • Size 30.6MB
        • SHA256 d649dd9e22435360e7aa4b9621e3ed1249c77eb18ec6045e1daf348d59de1d32
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javah.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
        • Size 30.5MB
        • SHA256 6d99b7658f6b1d6d83206fc56b3fa2ceb52eb6896b4ac6101e953f12f8611ddc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
        • Size 30.5MB
        • SHA256 ec9ce99d2983604161d3d7f23b741632a701749c7213c263b9ba0041cdbebc11
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javapackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
        • Size 30.6MB
        • SHA256 f39b1d85b06c2b5f6f103f9dfd912962cf031bc64f0c8e2897bd65d9048b0dc1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaw.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
        • Size 30.7MB
        • SHA256 fb05140168153624e779827dab3698930dfd7d0536c8cedd41074778fb7b8710
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
        • Size 30.9MB
        • SHA256 63faeb9c6be226930b3544be73d2f1b8bde33455bfc8f34296da55b37e4e9bcb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jcmd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
        • Size 128KB
        • SHA256 018b597827351ef5fba9c0e1d321cfa9b45d887ff0f8d5607452eb75d8626cb5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jconsole.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
        • Size 30.5MB
        • SHA256 c6a1c720b1e23a1bde8e53ea87b98e606719dbb6fdaf2051f638e29c4cf48245
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdb.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
        • Size 30.5MB
        • SHA256 d97870a82a249349565cb87f6de14a4905bd483ccc841ce0f16549260ebbf939
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdeps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
        • Size 30.5MB
        • SHA256 1a5a2fc955b742b2d5bbe40c08d5b68a1337fb02a04c17ed90cbc6b749676480
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jhat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
        • Size 30.5MB
        • SHA256 dab4b1db2b6e617d59fb20164e7c101498dfeae95cdf178434efdcecb6c9122b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jinfo.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
        • Size 30.5MB
        • SHA256 675117e2427d6c89ad5b48915421f430e7d974e917c7bd1069e00a804295cd40
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jjs.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
        • Size 30.5MB
        • SHA256 ab612e0a8dd71110fa2b22c3213d3236dfcbdd939f0841fdc6cbacf89e930d29
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jmap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
        • Size 30.5MB
        • SHA256 0800e4073ecb6758fbd934c1b2381f34b784c60ff2309d2acf8cfb68dcdf8d94
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
        • Size 30.5MB
        • SHA256 e9dd16dab90cabde0444fd6207c588fbc0d8aa844445e69c2892a2bbc1e9c7d3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jrunscript.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
        • Size 30.5MB
        • SHA256 7cd9419e670b5ea1768f8e720853c9a50fb212e74f267c224da4445422e8e5f0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jsadebugd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
        • Size 30.5MB
        • SHA256 d48e2779b8eda4e17d22dacf1e1898d8bc83bab07331e6e845b6f425fb0fde66
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstack.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
        • Size 30.5MB
        • SHA256 5f78bfbe728fb836894f9a8ae2787193ac9939adae8cc61178b397e0d9c55e64
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
        • Size 30.5MB
        • SHA256 c6a3f3dc7ae535524cd3184a8a0b8e3481fdfebe0ac534287b1f61663d78b143
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstatd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
        • Size 30.5MB
        • SHA256 cf23e85f14c3852e57e0c9c0e4c9c4d7e4abb8ea846c01fb2e2d40eaa47faec1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        keytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
        • Size 30.5MB
        • SHA256 73cbb0e6a80c00a98f22cb2f3c08c887809bfd4677760eb2f2e21d7151720a41
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        kinit.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
        • Size 30.5MB
        • SHA256 52af6088a86305183e409b147fba158239ab21a118c5f5f51df63299f9057a70
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        klist.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
        • Size 30.5MB
        • SHA256 b06d34c2fc264e9ca972efa6d52bdeb656cd8a53aa8b76713b42085960dd8476
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ktab.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
        • Size 30.5MB
        • SHA256 9149c295a07373e7d83ab0b80aa1a14ab24fce6f38502149c4dc117e1cf7bf65
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        native2ascii.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
        • Size 30.5MB
        • SHA256 947fc898789bce2bb03dd12c20470e176126535a12e23681c798599b5da312de
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        orbd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
        • Size 30.5MB
        • SHA256 ec3f14830384a9733b1b03624117931aefcbdf680e6d4fd4df91c3e390b08dc1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
        • Size 30.5MB
        • SHA256 18ab7fcfe12d3af98aa7c316c4fa8be562ac4f536650eb436d5b8b8aaa09050e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        policytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
        • Size 30.5MB
        • SHA256 370aaf5a818d0b86e9686d57eb32db104adc6106164496f1cfc23acfdf35f7ca
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmic.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
        • Size 30.5MB
        • SHA256 12ba022be3c46e80b98b1d7ed79a8d65c83e0ed08e2dfca7328770d645a762a1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmid.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
        • Size 30.5MB
        • SHA256 5c0ea747d2d1910e06470557b349de74e9bb7421793807c294f7a6e812e3f84f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 30.5MB
        • SHA256 782fcf0e5444edfc924f413d2cfeed9e16efef7d10da8a51575e31c22185d156
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 30.5MB
        • SHA256 87957c60560532999650d7613f79169bbb2f62a28553b0ee779fa82b5cd861c8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/2840-5-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download

        memory/4660-0-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download

        memory/4660-1-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download