Overview

overview

8

Static

static

3

2026-08-04...ar.exe

windows10-2004-x64

8

2026-08-04...ar.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    150s
  • max time network
    150s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    04/08/2026, 14:02

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-04_d2d9f24677833f7d3f14a31949e6181d_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
  • Size 19.0MB
  • Sample260804-rb89faywev
  • SHA256 87f5ef6abb84377e9720794b10351b36dfa53097b1aaa811b5d6d908151bf970
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
defense_evasiondiscoverypersistenceransomware

Malware Config

Signatures

  • Drops file in Drivers directory 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Sets desktop wallpaper using registry 2 TTPs 2 IoCs
    ransomware
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies Control Panel 4 IoCs
    defense_evasion
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-04_d2d9f24677833f7d3f14a31949e6181d_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-04_d2d9f24677833f7d3f14a31949e6181d_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:2208
  • C:\Users\Admin\AppData\Local\Temp\2026-08-04_d2d9f24677833f7d3f14a31949e6181d_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
    C:\Users\Admin\AppData\Local\Temp/2026-08-04_d2d9f24677833f7d3f14a31949e6181d_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:4512

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        7z.exe
        • Path C:\Program Files\7-Zip\7z.exe
        • Size 19.5MB
        • SHA256 2b6ddc9d1fc935554860fe254cbcce6f654afef6b909a8331c34c09f7067ca3e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        7zFM.exe
        • Path C:\Program Files\7-Zip\7zFM.exe
        • Size 19.0MB
        • SHA256 87f5ef6abb84377e9720794b10351b36dfa53097b1aaa811b5d6d908151bf970
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        7zG.exe
        • Path C:\Program Files\7-Zip\7zG.exe
        • Size 38.7MB
        • SHA256 d6770711a1206fba19e3c157150270fa0f99ed672ea9b795a02bd95d1fe244d2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Uninstall.exe
        • Path C:\Program Files\7-Zip\Uninstall.exe
        • Size 19.0MB
        • SHA256 44be7189220ca2ce05465ead1b4639eda494684811ee192ca5d68e583435b8ec
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        InspectorOfficeGadget.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
        • Size 38.1MB
        • SHA256 b1e47306760c075f667f75b24626716fbb6a3e5b856326e1c39d7f35240b828e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        IntegratedOffice.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
        • Size 42.1MB
        • SHA256 886a2ee84ca7e760d58d5aa38f1a75f2df55daa32598709acc73c65ba4a2f60b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MavInject32.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
        • Size 38.4MB
        • SHA256 5045ed2d0fb232dc07f6a50fceff6614621708651da8cbd2215869105ca68b9a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        OfficeC2RClient.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
        • Size 61.5MB
        • SHA256 57b97d0e6fd22446cf16af3162f9f27de693cf1c41ac2e162c10cf8d827ad27f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appvcleaner.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
        • Size 21.1MB
        • SHA256 6ceb5ff6bb91c8b86cde940fd94f550c52e29ea1be573380906c42c05eac2442
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrmstp.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        • Size 44.1MB
        • SHA256 a045dc8f80fd8ff28cf7fa42e0629132402919f4b1a70d9c30c95f46019eb695
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_pwa_launcher.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 39.7MB
        • SHA256 90878f9c905310f7243b93f465a6381d3903dec97a85209922fd9ceddea71ecf
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        os_update_handler.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 39.9MB
        • SHA256 7aef6dfc0afb10475f44134fe0c1d2bbae607f114ab4f313c7c2227e51f838ed
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_proxy.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 39.4MB
        • SHA256 ff15de08bf4f3b3c426148ffcf7ed1d4d46e30dec3077f1a0b81b30d478f754a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 38.0MB
        • SHA256 9ae0cebfabdba04b11fddd91cff25deb1976b13f4335ad8449c412e5f9951bfa
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 38.0MB
        • SHA256 892024b114fa470aec99a35524d304bdf39db04c52b3efbd81af44499c29ee3d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 38.0MB
        • SHA256 d2171788ddff7a86ab7c667abe47d2c22b05db5d6c6d6d4b1bcb6190964e727d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 38.1MB
        • SHA256 ec3e1ffc9c9d6d0a279c94d84aafacb8f5f7d7564037eef8c04182e421522919
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jar.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 38.0MB
        • SHA256 e8c94be459b046b92097866c49678b6f496a6853e0ccba5e456f2936c4070aca
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 38.0MB
        • SHA256 b938d13bf9d3d240f93d2ea5d45bcbde0bf83f5817543c1570fe6df594f16043
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
        • Size 38.3MB
        • SHA256 1f19029153d3d0674c8b31fbfcc66ba9ef1e5c2615a2f6fefd066538a3dc16be
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javafxpackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
        • Size 38.2MB
        • SHA256 7bba921ecde6750d3a15d03ddd6d4bf3fb7074087265bc7c79e12fb32b1df553
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaw.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
        • Size 38.3MB
        • SHA256 95b0f2f9f950281a6ea6f14d471d2a9f095654f8bf17640d5f3b8131ea9c8293
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
        • Size 38.5MB
        • SHA256 8b23ecd37e7f752f16958def1f1206b09ffd878159f75ede8965383fce56bfea
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdeps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
        • Size 38.0MB
        • SHA256 1c77e0b82bd7de22711cdad107f3ad5a5eb09f6514bdc25cc8fbaa530e30e47a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jinfo.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
        • Size 38.0MB
        • SHA256 44bc6578523f55fa43febde4cf68d054c9d4e51202ba1f416b7e5a28332fc954
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dotnet.exe
        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 38.2MB
        • SHA256 1cef284db84c1fdba29cefdc193663981a141eb557de666aef98f8670fdbcb84
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 38.1MB
        • SHA256 bf57cf6faf290b73b65709c9233df275110701826e9aa64d6e55ff2cefadb40f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 38.1MB
        • SHA256 b9fc91e4e89bace5b4e4245156a89457536deb60128dfaeb83969279bd8e03d1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/2208-1-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download

        memory/2208-0-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download

        memory/4512-18-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download