Overview

overview

8

Static

static

3

2026-08-08...ar.exe

windows10-2004-x64

8

2026-08-08...ar.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    148s
  • max time network
    147s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    08/08/2026, 16:25

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-08_2077cfdd7e0612e709088d8db7edae6e_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
  • Size 11.0MB
  • Sample260808-txbleavtay
  • SHA256 ae74d7a7755a17c5d40cf45df1af3e2adfb59dfd835093d36bbb68ee04306710
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
defense_evasiondiscoverypersistenceransomware

Malware Config

Signatures

  • Drops file in Drivers directory 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Sets desktop wallpaper using registry 2 TTPs 2 IoCs
    ransomware
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies Control Panel 4 IoCs
    defense_evasion
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-08_2077cfdd7e0612e709088d8db7edae6e_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-08_2077cfdd7e0612e709088d8db7edae6e_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:4456
  • C:\Users\Admin\AppData\Local\Temp\2026-08-08_2077cfdd7e0612e709088d8db7edae6e_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
    C:\Users\Admin\AppData\Local\Temp/2026-08-08_2077cfdd7e0612e709088d8db7edae6e_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:4200

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        Uninstall.exe
        • Path C:\Program Files\7-Zip\Uninstall.exe
        • Size 11.0MB
        • SHA256 de45bbcd18ee7b01cf5015c670399d1fef702ac547de89490d933472ab758c04
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        AppVShNotify.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
        • Size 22.3MB
        • SHA256 e2fde7a4d78fe56bedd4f658c18e70ece5abb9056ef940f63b261264a229b714
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        IntegratedOffice.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
        • Size 26.1MB
        • SHA256 fba7094febb785dd3184a03c0be6e9e26bd7442e7be297dc4f5933cf7c586ded
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MavInject32.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
        • Size 22.4MB
        • SHA256 bdd25cc74864c596b19b508851df998d504a0279c371fb6e32a5eeb001ebcca7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        OfficeC2RClient.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
        • Size 45.5MB
        • SHA256 4d423f923e424c4c71a3999d072914f0580a97875bbb592319013e407c3e67fa
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appvcleaner.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
        • Size 13.1MB
        • SHA256 1cd0a1e89819f4bb6ce7d0c0092eba7d29368c53e29217fae0603c9c27f57c0a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VSTOInstaller.exe
        • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
        • Size 22.1MB
        • SHA256 2de3bb1c4332e14320a95f7366fae76092d284af6971a25c4f5f4b7803f90d75
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrmstp.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        • Size 28.1MB
        • SHA256 41240cb35f398aa6341ec382549ead727f148fe235ba5eca42ffec669cb1d14c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_pwa_launcher.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 23.7MB
        • SHA256 2c0649fb90c5c342069822296d777ec62d0d08e23d6170fb05357bcc69e663dd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevated_tracing_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 25.5MB
        • SHA256 1ede8375fd6475e00830c58732c837cba5b3bc750b7cdb5cb91bbd6c57a44601
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 24.3MB
        • SHA256 7805d30063be9cd7c4568907b3c922936e0aa79302896cc9f2f14e782d689ad4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notification_helper.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 23.7MB
        • SHA256 2f18fcf3c252670c440e850d1fe3df2e9e9febb42e4cec79d96c42a81dac7ae7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        os_update_handler.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 23.9MB
        • SHA256 29aace4b9c0713110839408bba56e07db56ef10bf03cd7bea8c0d6be5697e495
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 25.1MB
        • SHA256 661521caacd5ee87c5c677ea77b5a518f117ca357748185de2c212bea097db47
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_proxy.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 23.5MB
        • SHA256 d836c1daf6ef5e241bd18b0d7a3084968841a759fe26c145bc9c09ae9b7f57e5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 22.1MB
        • SHA256 4943249ff80943aa5e93a9831e5ba37fff94cebd2252f911af695f68d53d2fda
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 22.1MB
        • SHA256 f225e1eeb0e5d12afc3f202eab5a53320cf3b0e6b70445e6057e07bd7d1ac847
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 22.1MB
        • SHA256 be3a3ff674f4237ed02077ff28234fe55295251eb112c16126cdb959431d43f9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 22.1MB
        • SHA256 34efc9af6291fa0505ae9d3c0f63b3bac41ebd7ee0d3fddf9589d62524ff27f9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jar.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 22.1MB
        • SHA256 4d3ef2c86fa7c2e6e43c4b806148d96374faf4fa9069c002418a4b4ee0398ea7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jarsigner.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        • Size 22.1MB
        • SHA256 49a995fdd3fa886fce9ce7f225b052f1bd78062da2d57ac3edb42125b01dd6dd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 22.1MB
        • SHA256 f5fa4f1bec92df20939faf51e972954c1b89e792ea6d31c9937ad40122220836
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
        • Size 22.3MB
        • SHA256 a620bcb0262bba75b7d344bff327c0cadfeefe3e88d743c99d11a624949d26dc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javac.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
        • Size 22.1MB
        • SHA256 3163611c669cd43576b51fddd8400c4b410814a432f9c82641d4666ef75ff41c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javadoc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
        • Size 22.1MB
        • SHA256 23ae1d631cd196f21e50fafa64de7d2078a4f6dde576348e9a90e7a346bb9b64
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javafxpackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
        • Size 22.2MB
        • SHA256 5a13806564050ffe9d165958d633c9f6b52d7411c65cfffa6cfb5f425c5d2eb8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javah.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
        • Size 22.1MB
        • SHA256 cbb255ff66a60c567fa2419bda099d636e94b1aa85bd6903cee88f1d7d7dbe74
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
        • Size 22.1MB
        • SHA256 465c6d4994ff8e10cb599d7b21e895576f031c5d2cb2b8e06f42ddece672f763
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javapackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
        • Size 22.2MB
        • SHA256 3d400e1d38c88a96a82f6adddc3631140bedb3cc9b2a094c8f720342aec7f195
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaw.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
        • Size 22.3MB
        • SHA256 52800b6cfee51ec19b1cc678cc7da4594c4d224010ad4632994e9e4cb52d32e1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
        • Size 22.5MB
        • SHA256 eabb57ae502d8b3f73d73bbce38da31200bc27b8b6f3d79cad43875c7565fae5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jcmd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
        • Size 22.1MB
        • SHA256 b0d8090f68dcc539970accce5fcd3d9c651f0f47d9b44ea81047fe53ff2fa648
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jconsole.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
        • Size 22.1MB
        • SHA256 eb9ffeaee4a61e032f734a0e34171bb178d251b94c6d39b6291f2a85aff9d717
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdb.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
        • Size 22.1MB
        • SHA256 5d211e217877427c6ff1dfd8bd650c03ecddd9ff17e32f8ea6abfe508e690225
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdeps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
        • Size 22.1MB
        • SHA256 22ffb393cdab1a7add7b926173f08c7198fa39c31688b2bb25bbd8a3be2e5e0e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jinfo.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
        • Size 22.1MB
        • SHA256 0997780861e083c386e5418a52e77d82323a709c1d29bf3f5fb88b41381485d0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jjs.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
        • Size 22.1MB
        • SHA256 f4cf7bd3be5dc935666fb6e05a622dda7c35ad6f1ffd9c871f5fbc86eebe10e0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jmap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
        • Size 22.1MB
        • SHA256 58e88de93de7f7ce30fe22bc1fefb8ac19fb941765fd53cf8073269a2a7c6906
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
        • Size 22.1MB
        • SHA256 de08920e388826c0ded3329652adc267e08bf9e52dc15e90701beebdeda604e5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jrunscript.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
        • Size 22.1MB
        • SHA256 1ff5e01dacb8f2ac177e23bdd5dd6335c3b91fdc6f0bd4181f5787097a2202eb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstack.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
        • Size 22.1MB
        • SHA256 a8c362aa5ade4c0d53ab3b4bb1bb77b4f6bd4eda86b75bef5d0bcb3402f9b901
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
        • Size 22.1MB
        • SHA256 271cb61a52d768976c78d3713dfff8d9239d575c190b212ffbeb37493c700c17
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstatd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
        • Size 22.1MB
        • SHA256 639893380d952f0b57b2defea64f77be15e86915e2104e4d5305c1ed6be4900c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        keytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
        • Size 22.1MB
        • SHA256 5e6660804fc5f626b2145007762e9cd54355aceb6d4eb9c6fad663553300ec91
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        kinit.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
        • Size 22.1MB
        • SHA256 dc8a6fb4270f9d08dc6aa1c6545ce7c5b0f2e3fcf95da88cbc0dc38808e49dc8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        klist.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
        • Size 22.1MB
        • SHA256 89d29f8cc18237109eae32ef8bcb6d947dfc64e28014c523054ed7f1e6a1c398
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ktab.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
        • Size 22.1MB
        • SHA256 235206cac744bc8d6652e5bcc678838a7b81771681a02eb07d818f7eedc0625f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        native2ascii.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
        • Size 22.1MB
        • SHA256 d4938e527e841a402be925589fd77cd0815b8577e9dfc7b79192e18d924f447b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        orbd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
        • Size 22.1MB
        • SHA256 eb486e9b85056294e259d6559d5eac043444f2610cdd9b3dfd219d443495fb34
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
        • Size 22.1MB
        • SHA256 6b49059a2a4f4066b97405382fe5dd2fe2b401b9bcd611e2c869839ed08a5403
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        policytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
        • Size 22.1MB
        • SHA256 f7ba853a579195d07e008aca26e3908924ddf65629364d138fb716452e514aae
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmic.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
        • Size 22.1MB
        • SHA256 15f38d668fb7bedcfc0bf8cca5bdee3b82d66f60c9fa758403c225378534fb51
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmid.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
        • Size 22.1MB
        • SHA256 62d51504f5da9b769d2bd0d32d4f7c06cce63dd67a0bb9441c2786c3c90955e1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmiregistry.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
        • Size 22.1MB
        • SHA256 691be5303655a4d630d3339c66bbf0f00583c6c8b48933fe98145b44b93f176d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        schemagen.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
        • Size 22.1MB
        • SHA256 84d1ca37b7752a9cf03bae58abde0f77e60dd44de38eb40440d3a5391d8dd828
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        serialver.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
        • Size 22.1MB
        • SHA256 539058d5d8b2e8805133da81e9634d1585148aef36f01909edc740c00888eddd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dotnet.exe
        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 22.2MB
        • SHA256 a5ec008d625c283e419c364d421e09d1246cef3ce8cef66bcbe94dc53e007bd0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 22.1MB
        • SHA256 11da8ede346946f124c8386b1aa0e3b13f07b8c2143c3733e549c925a9531434
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 22.1MB
        • SHA256 0a5dec30ec99633ec065e877bdf18849983a70e2faf64f0d84440c13eba66335
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 22.1MB
        • SHA256 cd5934afd07f24580afa6fad9295d2b9fe8ea0786183f621a62ceea10ad8aca0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download