Overview

overview

8

Static

static

3

2026-08-04...ar.exe

windows10-2004-x64

8

2026-08-04...ar.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    94s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260513-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    04/08/2026, 14:02

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-04_d2d9f24677833f7d3f14a31949e6181d_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
  • Size 19.0MB
  • Sample260804-rb89faywev
  • SHA256 87f5ef6abb84377e9720794b10351b36dfa53097b1aaa811b5d6d908151bf970
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
discoverypersistence

Malware Config

Signatures

  • Drops file in Drivers directory 3 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-04_d2d9f24677833f7d3f14a31949e6181d_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-04_d2d9f24677833f7d3f14a31949e6181d_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:3188
  • C:\Users\Admin\AppData\Local\Temp\2026-08-04_d2d9f24677833f7d3f14a31949e6181d_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
    C:\Users\Admin\AppData\Local\Temp/2026-08-04_d2d9f24677833f7d3f14a31949e6181d_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:2020

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        7zG.exe
        • Path C:\Program Files\7-Zip\7zG.exe
        • Size 19.7MB
        • SHA256 c61d47225e01f67fed843d4996d318891325d300589ee277d0131103e3c713f1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        setup.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
        • Size 25.1MB
        • SHA256 b213a1ee823e0d214eb8a3b922ff59522b543a2ab3c33244c02b0547a747032e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevated_tracing_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 22.5MB
        • SHA256 efa01da525d30feb993a4310be27d5a65a61fcd154c8126161b47fd6361e3307
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notification_helper.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 39.7MB
        • SHA256 d6e4dbae46de7e6481428ca237274ab95951e03b8f98351796d953ee266cc46c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        os_update_handler.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 39.9MB
        • SHA256 7aef6dfc0afb10475f44134fe0c1d2bbae607f114ab4f313c7c2227e51f838ed
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 41.1MB
        • SHA256 ada5bb45c333d8f336d328a6d3a3498db2ce995111d2a96136ab029e2e0c0649
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_proxy.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 39.4MB
        • SHA256 ff15de08bf4f3b3c426148ffcf7ed1d4d46e30dec3077f1a0b81b30d478f754a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 38.0MB
        • SHA256 9ae0cebfabdba04b11fddd91cff25deb1976b13f4335ad8449c412e5f9951bfa
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 19.0MB
        • SHA256 f40ea5b5770183a50bac13b8e0fb2e3517730de65965e177052753bfe4657ea9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 38.0MB
        • SHA256 d2171788ddff7a86ab7c667abe47d2c22b05db5d6c6d6d4b1bcb6190964e727d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jar.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 38.0MB
        • SHA256 e8c94be459b046b92097866c49678b6f496a6853e0ccba5e456f2936c4070aca
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
        • Size 38.3MB
        • SHA256 1f19029153d3d0674c8b31fbfcc66ba9ef1e5c2615a2f6fefd066538a3dc16be
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javac.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
        • Size 38.0MB
        • SHA256 218bf369cf871e3b4f122b007e4bfcd7edb77c8031fa56b408c2fa9f415e0ad5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
        • Size 38.0MB
        • SHA256 77b88605e7990f5c8382f1d510b6c916c8b44b5752f5843b6eed9a8b1d26ddd2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javapackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
        • Size 38.2MB
        • SHA256 d17779e96358fd13f026f3719bac4750595f8b257b716904a81799c15f615594
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaw.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
        • Size 38.3MB
        • SHA256 95b0f2f9f950281a6ea6f14d471d2a9f095654f8bf17640d5f3b8131ea9c8293
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
        • Size 38.5MB
        • SHA256 8b23ecd37e7f752f16958def1f1206b09ffd878159f75ede8965383fce56bfea
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jcmd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
        • Size 38.0MB
        • SHA256 9beae1a888da6195ff969ffc6db6acba5e74c08448b02073f5d3888f1e8e1548
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdb.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
        • Size 19.0MB
        • SHA256 67bd1f667a61cc795b93fa28249cbe90b9fc8b74bc63e1ec05f7750b4eb2d1bf
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdeps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
        • Size 38.0MB
        • SHA256 1c77e0b82bd7de22711cdad107f3ad5a5eb09f6514bdc25cc8fbaa530e30e47a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jhat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
        • Size 38.0MB
        • SHA256 1af33bed35190d3278e6b1d6db02c243f54cc366f33e160bd630ec6fc3ec014c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jinfo.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
        • Size 38.0MB
        • SHA256 44bc6578523f55fa43febde4cf68d054c9d4e51202ba1f416b7e5a28332fc954
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jjs.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
        • Size 38.0MB
        • SHA256 2a58015a5bd795e0a8d757aa1c2cd96afcfb2caac8250c2f50275a761cce3a49
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jmap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
        • Size 38.0MB
        • SHA256 1877aeeb94e2072ab2b6805819f3be7f322825c31f5550fecdcd7ab35fbda1d6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
        • Size 35.4MB
        • SHA256 b2ebe44f6dfcc956bf14ca7d4c2b58462b1f82b17b6a9cfde99ff665ac62692f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jrunscript.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
        • Size 38.0MB
        • SHA256 da865dc5b3cdf43b2b81b6b00948ccbafd40937caabf9d9bf4ec34341b2c896c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jsadebugd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
        • Size 38.0MB
        • SHA256 2ede201452216e91b1672f41d4a739785ad8f5e09bfad2dde42b4cb14ada4281
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstack.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
        • Size 38.0MB
        • SHA256 b2545a1383768aa0187b8b489f9b25b76cc1678c0a462345ad9b21a449739f6b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
        • Size 38.0MB
        • SHA256 592f610f3078907c0ce59336db0bc08c2ed7067dd21de6c747a5b84af15c206c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstatd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
        • Size 38.0MB
        • SHA256 774319200c934c87e9f4e9541fdf12748ab0e817f4c6138ac261e0909560db6e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        keytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
        • Size 38.0MB
        • SHA256 8b200cbcc91f816dc47ac10d20de6ce504475fa55008fd1b0c2479b2569a3902
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        kinit.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
        • Size 35.1MB
        • SHA256 fc0af878f5ef0347db687e6927071927321bf0815e0881ef75e12374720fe2a4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        klist.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
        • Size 35.8MB
        • SHA256 2c2ea247968e7edab36de60e0f1b7df5e3ef541e9a10a432d169d032e56959f8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ktab.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
        • Size 38.0MB
        • SHA256 180511fa8bd522a3bf4e89d1ed53ed2602e7ec124ce95253d38bf41bd960415f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        native2ascii.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
        • Size 38.0MB
        • SHA256 bd723eb2c1b48c7d9e4951eed1126dda63f5f75a16c8188af85c47fd2b3c35a3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        orbd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
        • Size 36.0MB
        • SHA256 94001b5dc71e78666465efab324e14898fc1e516edf0156bda96227bdd71e7c6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
        • Size 38.0MB
        • SHA256 fe28c67f9631209bf984c36d0b21b1b04873dacd159c50f20d2d6c760ccac79d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        policytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
        • Size 38.0MB
        • SHA256 a5aa3490df70fee89f43662ab95bd8870ae062970bd7a74a382d00942e351c33
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmic.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
        • Size 38.0MB
        • SHA256 8ee02c58283eb6318758f2bc40cc397630534e380dd277085dcd2499682ba5d3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmid.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
        • Size 29.9MB
        • SHA256 edddd12d220e3a41adeafb046c840faf14ee9a3e111f03cdab2375d8b34ec5ad
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmiregistry.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
        • Size 29.5MB
        • SHA256 6be57c98c3bdbdc91e90e209dc8aa28295122ed510cf1617ba35748b76c78db4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        schemagen.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
        • Size 29.1MB
        • SHA256 06e86ae370f598c8dc1aa726d87430b72a6b766aa91499000764c37eeb653c64
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        serialver.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
        • Size 26.8MB
        • SHA256 05bb74e5469a164c3627f5e98e7de1eefd0128207cc9d408e7cda3c7c326a055
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        servertool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
        • Size 26.9MB
        • SHA256 415b52e4394d4182cd4297882c4c92b229c5d5736afbdf1fc119d25b5f5e6381
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        tnameserv.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
        • Size 26.2MB
        • SHA256 6a8d193c1a4cbc3b5b3bc964daf15e7711fa0d20167fba27b3f91d6f1e9bb816
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        unpack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\unpack200.exe
        • Size 26.5MB
        • SHA256 964b0c8f5bc301c874e133e6dd74ada29ed8728d4a4b127c580c14bf6de89a24
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        wsgen.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
        • Size 26.4MB
        • SHA256 4f542ae861dc8b672d6d2b8b719ac533aecdb2165dad21c3c96267fc8acc199f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        wsimport.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
        • Size 26.4MB
        • SHA256 9784cf95330c0dd72a66a45f88811db1f8ded4add55b5a98cbb5286c9626af10
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 19.1MB
        • SHA256 7ea9be615aa393d782e7af7e91d2c1eeed1d7fc47a094cf78f62b275f6dad776
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        spo0lve.exe
        • Path C:\windows\SysWOW64\drivers\spo0lve.exe
        • Size 19.0MB
        • SHA256 87f5ef6abb84377e9720794b10351b36dfa53097b1aaa811b5d6d908151bf970
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/2020-5-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download

        memory/3188-0-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download

        memory/3188-4-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download