Overview

overview

8

Static

static

3

2026-08-08...ar.exe

windows10-2004-x64

8

2026-08-08...ar.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    148s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260513-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    08/08/2026, 16:25

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-08_2077cfdd7e0612e709088d8db7edae6e_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
  • Size 11.0MB
  • Sample260808-txbleavtay
  • SHA256 ae74d7a7755a17c5d40cf45df1af3e2adfb59dfd835093d36bbb68ee04306710
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
defense_evasiondiscoverypersistenceransomware

Malware Config

Signatures

  • Drops file in Drivers directory 3 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Sets desktop wallpaper using registry 2 TTPs 2 IoCs
    ransomware
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies Control Panel 4 IoCs
    defense_evasion
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-08_2077cfdd7e0612e709088d8db7edae6e_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-08_2077cfdd7e0612e709088d8db7edae6e_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:5700
  • C:\Users\Admin\AppData\Local\Temp\2026-08-08_2077cfdd7e0612e709088d8db7edae6e_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
    C:\Users\Admin\AppData\Local\Temp/2026-08-08_2077cfdd7e0612e709088d8db7edae6e_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:1820

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        7zG.exe
        • Path C:\Program Files\7-Zip\7zG.exe
        • Size 11.7MB
        • SHA256 05d55c02d4a8202e8c75288ec915674b73371596df1bfde646b82c9fcd71bc71
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        IntegratedOffice.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
        • Size 15.1MB
        • SHA256 9b18b1520ab57cc9417803820162bd76ee8e6c1cbf3173ffe7ebbab856891575
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VSTOInstaller.exe
        • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
        • Size 11.1MB
        • SHA256 3b3c357049429e248d3c7dcd15ac9328a4558303f54f189641c3f971fbe16c51
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_pwa_launcher.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 12.7MB
        • SHA256 222e2829a1c6d18651c4f381ac65d5c341533ab3cdddde52aaeabf57b7ff253d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 13.3MB
        • SHA256 8e9b0c7d100b0f8e09f8c269811b04c21619a239d60bcdb1f1ebb536c2409ce8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
        • Size 11.3MB
        • SHA256 2043f49c40f781092763f2cb7a48d3e74b9e496a15a3f4ca017e74fea8e44632
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javafxpackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
        • Size 11.2MB
        • SHA256 0fdf631461b8160b5f8ae992a2e4a8129149cc000b98c184d8732aba1da1124f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
        • Size 11.0MB
        • SHA256 d476aad5dfaae683696af493c385d1b0a78659b5685bebed38d6f8e33b473199
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaw.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
        • Size 11.3MB
        • SHA256 5073b7ab6a5fe5ca7e0acc5ad38206c3f012c7609876de32277f494181cccfb0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jcmd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
        • Size 11.0MB
        • SHA256 bf9964d2617990d1035d137433e4d833f9168db356a5d944283999821c896319
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jconsole.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
        • Size 22.1MB
        • SHA256 eb9ffeaee4a61e032f734a0e34171bb178d251b94c6d39b6291f2a85aff9d717
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdb.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
        • Size 22.1MB
        • SHA256 5d211e217877427c6ff1dfd8bd650c03ecddd9ff17e32f8ea6abfe508e690225
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdeps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
        • Size 22.1MB
        • SHA256 22ffb393cdab1a7add7b926173f08c7198fa39c31688b2bb25bbd8a3be2e5e0e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jhat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
        • Size 22.1MB
        • SHA256 af61953c8c08c6fe83188650f7e1374c951854cd617332a41f461e112f0ba8e3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jinfo.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
        • Size 22.1MB
        • SHA256 0997780861e083c386e5418a52e77d82323a709c1d29bf3f5fb88b41381485d0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jmap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
        • Size 22.1MB
        • SHA256 58e88de93de7f7ce30fe22bc1fefb8ac19fb941765fd53cf8073269a2a7c6906
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jrunscript.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
        • Size 22.1MB
        • SHA256 1ff5e01dacb8f2ac177e23bdd5dd6335c3b91fdc6f0bd4181f5787097a2202eb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jsadebugd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
        • Size 22.1MB
        • SHA256 a36bb5fa6a7052b475e0bc1533c8990086b60a32633ccf7a9d773cbd68925b12
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstack.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
        • Size 22.1MB
        • SHA256 a8c362aa5ade4c0d53ab3b4bb1bb77b4f6bd4eda86b75bef5d0bcb3402f9b901
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
        • Size 22.1MB
        • SHA256 271cb61a52d768976c78d3713dfff8d9239d575c190b212ffbeb37493c700c17
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstatd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
        • Size 22.1MB
        • SHA256 639893380d952f0b57b2defea64f77be15e86915e2104e4d5305c1ed6be4900c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        keytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
        • Size 22.1MB
        • SHA256 5e6660804fc5f626b2145007762e9cd54355aceb6d4eb9c6fad663553300ec91
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        kinit.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
        • Size 22.1MB
        • SHA256 dc8a6fb4270f9d08dc6aa1c6545ce7c5b0f2e3fcf95da88cbc0dc38808e49dc8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        klist.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
        • Size 22.1MB
        • SHA256 89d29f8cc18237109eae32ef8bcb6d947dfc64e28014c523054ed7f1e6a1c398
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ktab.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
        • Size 22.1MB
        • SHA256 235206cac744bc8d6652e5bcc678838a7b81771681a02eb07d818f7eedc0625f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        native2ascii.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
        • Size 22.1MB
        • SHA256 d4938e527e841a402be925589fd77cd0815b8577e9dfc7b79192e18d924f447b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        orbd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
        • Size 22.1MB
        • SHA256 eb486e9b85056294e259d6559d5eac043444f2610cdd9b3dfd219d443495fb34
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
        • Size 22.1MB
        • SHA256 6b49059a2a4f4066b97405382fe5dd2fe2b401b9bcd611e2c869839ed08a5403
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        policytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
        • Size 22.1MB
        • SHA256 f7ba853a579195d07e008aca26e3908924ddf65629364d138fb716452e514aae
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmic.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
        • Size 22.1MB
        • SHA256 15f38d668fb7bedcfc0bf8cca5bdee3b82d66f60c9fa758403c225378534fb51
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmid.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
        • Size 22.1MB
        • SHA256 62d51504f5da9b769d2bd0d32d4f7c06cce63dd67a0bb9441c2786c3c90955e1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmiregistry.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
        • Size 22.1MB
        • SHA256 691be5303655a4d630d3339c66bbf0f00583c6c8b48933fe98145b44b93f176d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        schemagen.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
        • Size 22.1MB
        • SHA256 84d1ca37b7752a9cf03bae58abde0f77e60dd44de38eb40440d3a5391d8dd828
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        tnameserv.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
        • Size 11.0MB
        • SHA256 3e5df9d0a554a7c151f5ddcbaba94de8d957b17be8fc6253549839888e913494
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        unpack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\unpack200.exe
        • Size 11.2MB
        • SHA256 fa94fb690337424a08f1af55916381d7477ee106faffff77ff67f2cc6a864cb4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        wsgen.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
        • Size 11.0MB
        • SHA256 583b39757930aab865860975902aa920712fd89551265bf87192ee178e778bee
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        wsimport.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
        • Size 22.1MB
        • SHA256 8d7c0e67a1b4a24919a82842103803a2ea990d79fd79fd6eac9d3e232b073eb2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        xjc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
        • Size 22.1MB
        • SHA256 881232aac5b4972a0a4c852a17fe8f2640a16eaecd48511fc5e19cb8c34b46c8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe
        • Size 22.1MB
        • SHA256 c4e2dcf27de37d538c40a91f148f6c5feb40602a71fbc4bcb7ffcafc9c4c8395
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\java.exe
        • Size 22.3MB
        • SHA256 07d7970dfc0d49ac33954ebbadf753436c1746f8bc6cd52c15c66f9bcc9f20f9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javacpl.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe
        • Size 22.1MB
        • SHA256 8b587547264e8d0d81bb94ae53e42a654beb1ac84654cf6f4191e7e477553c73
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaw.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe
        • Size 22.3MB
        • SHA256 634596139776a9a6dd7f9acff77d9b69084d819975e2016b3588d9fe80f93027
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe
        • Size 11.5MB
        • SHA256 7589462cb566983d09e66f48040696b20bf95853a9292e1ec40b5ff0a3b850ee
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jp2launcher.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe
        • Size 11.2MB
        • SHA256 a139e6d452e4cffac45d684a51b0ce996e9f02d42f6b4b0c636c82207c822470
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        keytool.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe
        • Size 22.1MB
        • SHA256 e6bd44a796e0a9d43b22554a75267bce869e69903daa819c787da1ec0453de7f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        kinit.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe
        • Size 22.1MB
        • SHA256 54521335262dc5e995628e3bcbdc9f46d9a5e8c7c481a1a7971f5e8a0e50e871
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        klist.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe
        • Size 22.1MB
        • SHA256 69d52650464690931db5b310bf9c1de4d3b7986db3ce302854ff9c7eb9ff0d79
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ktab.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe
        • Size 22.1MB
        • SHA256 e868b163c6d08d0a59c1ae25c53331dd434bae194f5e630b2ab273f442a082d2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        orbd.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe
        • Size 22.1MB
        • SHA256 8e8c728cb5ef6b47206697aabf7af102b98d411e838244fb1312f59561b52965
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pack200.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe
        • Size 22.1MB
        • SHA256 d4f132f14196c0ae5e6fc979335bca5605debefc15f0961aa2187f34cb5a7988
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        policytool.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe
        • Size 22.1MB
        • SHA256 c264ef50f76b9f9e9df73868eeef2bb990ad454efe0d40d769e59a9bf7e4771b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmid.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe
        • Size 22.1MB
        • SHA256 ab6b25bf293f9ee204fa25a88db6eafe1a3bd153cc592e4d6851d011f3a5c534
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmiregistry.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe
        • Size 22.1MB
        • SHA256 6a739ab06efc5f5712cf8c79ef3b7309d0ad0dc7297a806948001af10eabc549
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dotnet.exe
        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 11.2MB
        • SHA256 fc636209c1ad737f56ac5309c0d483ebbbd0792e6f86223fd9959f45af5efcdc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        spo0lve.exe
        • Path C:\windows\SysWOW64\drivers\spo0lve.exe
        • Size 11.0MB
        • SHA256 ae74d7a7755a17c5d40cf45df1af3e2adfb59dfd835093d36bbb68ee04306710
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download