Overview

overview

8

Static

static

3

2026-08-09...ar.exe

windows10-2004-x64

8

2026-08-09...ar.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    149s
  • max time network
    152s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260513-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    09/08/2026, 16:26

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-09_86dd5be111015bede0d71be2c5dbf536_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
  • Size 12.8MB
  • Sample260809-txm97shr9w
  • SHA256 013ed617d2c7e8e0cb283300ff09a3ec0588d9fa714c6be0db077867846eb88e
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
defense_evasiondiscoverypersistenceransomware

Malware Config

Signatures

  • Drops file in Drivers directory 3 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Sets desktop wallpaper using registry 2 TTPs 2 IoCs
    ransomware
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies Control Panel 4 IoCs
    defense_evasion
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-09_86dd5be111015bede0d71be2c5dbf536_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-09_86dd5be111015bede0d71be2c5dbf536_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:4532
  • C:\Users\Admin\AppData\Local\Temp\2026-08-09_86dd5be111015bede0d71be2c5dbf536_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
    C:\Users\Admin\AppData\Local\Temp/2026-08-09_86dd5be111015bede0d71be2c5dbf536_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:5032

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        7z.exe
        • Path C:\Program Files\7-Zip\7z.exe
        • Size 13.3MB
        • SHA256 4d500a626d07050f51fe4e7aa5962699c899f4540da7c342c58c2b6826d450cc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        7zFM.exe
        • Path C:\Program Files\7-Zip\7zFM.exe
        • Size 13.7MB
        • SHA256 987361f0deb3737957021ba987c90b3751635eb971e48d07f400433d7687e12a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        AppVShNotify.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
        • Size 25.8MB
        • SHA256 bab930bfb0850a09c18405450819192d1c310055a2a36e4d49e5d7e2f0b52e8a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        InspectorOfficeGadget.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
        • Size 25.6MB
        • SHA256 dfecad240c21e5a8f97bae187934d03b3c76d924d87015a3c39c4c2f3e5fba69
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MavInject32.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
        • Size 25.9MB
        • SHA256 da31fbd4a2458d86015489d7bdbc2f609db387ce150aa780d80cba32f68abcc1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        OfficeC2RClient.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
        • Size 49.0MB
        • SHA256 b4a9d1115ba5f3550affe9ef9a267523da1105a3ed710abc23ef86dac611b09d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appvcleaner.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
        • Size 27.7MB
        • SHA256 9ad1fec748a64b62ea0720643be92873f5ff4f78bb35aecef92e6432d0aca6c8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VSTOInstaller.exe
        • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
        • Size 25.6MB
        • SHA256 36fa8fe4db2510aa4d02c6ffde8eda5a0936f3c9830d0299e718427a300537e2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        setup.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
        • Size 31.6MB
        • SHA256 6af0da486a11870c70832d0d7aaa532d1d2e4644f2891260e3a3ad4d2dd14999
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_pwa_launcher.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 27.3MB
        • SHA256 9b93051dd50080c131dc04e2cfaf874e8eb34ffea00ccaabed0b3d8b7d6199c9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevated_tracing_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 29.0MB
        • SHA256 3267364b9df3eb859db83c9a59a972a19c04a73439bce84035e1ba6910fc96d9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 27.8MB
        • SHA256 f774f0c1405b0a8e022f24d1768bfeb58a827c251e54933dfda58caf6b096922
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notification_helper.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 27.2MB
        • SHA256 31e0f75def68b95d17be0f389b6e3daddb1da2b36e808fbe2ad65bbd71730188
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        os_update_handler.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 27.4MB
        • SHA256 a50765ca96e6efdbb2c8314335a9da28158074734d22463ecb547275a2e4b6b2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_proxy.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 14.2MB
        • SHA256 4e3a893fb40ffa59e38af1f4fa608b7eb1123c6716e18673aaabb97183d1c526
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 25.6MB
        • SHA256 2f21697f2352ce5e1a5323978349dde7ff9cab4f65555de03e73064b8408a8c2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 25.6MB
        • SHA256 558f5cdd3b5757d464a1e07c000b460896cbd444cb522cd4f35bd18c8e9a7bd2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 25.6MB
        • SHA256 0e7c03159fadd3429a9ad3a46321fe8afa36c1ca7ff1016648f03e88d474eac7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 25.6MB
        • SHA256 1f59adcac2018f1f347fa74906e7b70eb985abc1a42176463f023b813997543b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jar.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 25.6MB
        • SHA256 af2fb569c83b9a3ed82a7dba3097750615052655cc8cac38c50b9c5d665c8e82
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jarsigner.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        • Size 25.6MB
        • SHA256 3d7e6103bc7c520d651a0247be466354b067fba13c06549a96b80d88c701b565
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 25.6MB
        • SHA256 1b867dbb7088534c0fdc47f754ab511d5f57757e54468209e8e9833539717452
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
        • Size 25.8MB
        • SHA256 ab662e43bd342fe019f6740fac3766131ba94f52876878721081d4c0caf43409
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javac.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
        • Size 25.6MB
        • SHA256 894b6e087fdb642e9cc23fad2a273a2edfe69d4e6c81c59e0b7cf7a96484b4ec
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javadoc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
        • Size 25.6MB
        • SHA256 60231b7f4b383126918c265dc763b7ef12d4150ad9ad1160db2af8b270cf4996
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javafxpackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
        • Size 25.7MB
        • SHA256 04a8d530fa1c0d07bde3cc52e97f353654e959bc7a1cb3dea5be5f86ed1e83ca
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javah.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
        • Size 25.6MB
        • SHA256 a26c6d0e520b53c6fceedd8944232ed0fdbd5b56a540b1da80fc21dedd0120f1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
        • Size 25.6MB
        • SHA256 e23c59d5453e0a5c60a6589dc4762bec0081551c668fc821458b33c47d2e8975
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaw.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
        • Size 13.0MB
        • SHA256 c9e6d661829b512bc22ff889c44ee861628cbd80cdc7e2d2f31aa7267e631518
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
        • Size 26.0MB
        • SHA256 b633a8910a7d07f0dcb70bbf85eefa2c1978647e02ecd39c25a89319e51d09a7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jcmd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
        • Size 25.6MB
        • SHA256 2021d63a436f3b0a611e36dcd8913edda019ee40190a2d2f21134b271fb2f035
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jconsole.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
        • Size 25.6MB
        • SHA256 4889cad8a15dab29830b77d73d45b9192a98b6546e6f6c2d01ae4b5802f837c9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdeps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
        • Size 25.6MB
        • SHA256 5cc2e15c2c179b27fdd538bdce5637510aa3cbea99c20656ca963c82293be040
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jhat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
        • Size 25.6MB
        • SHA256 1ac38ac2e9d253b14046f385a6fa64e8962a874db7a82e07977dd371be18cea3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jinfo.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
        • Size 25.6MB
        • SHA256 39a82d855a2f521b86fe87ca871cd64f7222bfa7e61599f0bf55fe6683b1190c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jjs.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
        • Size 25.6MB
        • SHA256 e2dbf7a6b431d29fbec09023c2de55b561320489bd6f819572f952e3ab8e1812
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jmap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
        • Size 25.6MB
        • SHA256 70e4f1bc6dad448d06ac41af5c6ab661cf846534097523adac54bd8404861bb7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
        • Size 25.6MB
        • SHA256 67954cf9e0ebb8a59eea2e810390e188b86faa4f4b4541be13708771b0dfacaf
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jrunscript.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
        • Size 25.6MB
        • SHA256 20426d14e140323d4db4fb6c27c1594f95b8716b036de30c4ce008579ddf61b1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jsadebugd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
        • Size 25.6MB
        • SHA256 d6a2af033b48a1cc071a34c518361a6f1605e4f470484f76011bee3129821013
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstack.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
        • Size 25.6MB
        • SHA256 b98d506345d134e5a6aa0f269f60b50885b26b4a4ff349c4d309d709144b5df3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
        • Size 25.6MB
        • SHA256 103cf83e63990361eb864eb729c5c09bc6a0dd1a2633a2ce323518fa5d019ea0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstatd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
        • Size 25.6MB
        • SHA256 3ec2593bc3e3cde53365058b714b5dd7e927b453d744c61c6a1a05b03d0b0f0d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        keytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
        • Size 25.6MB
        • SHA256 09856742a1150bc5165c8c8668bb19642511b66ae1b8ee5e9bc56abb9a2c676e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        kinit.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
        • Size 25.6MB
        • SHA256 bc38291e9d422f8b8071f3f99c9a7c33d48737ccca96f976ec61f496be3b3e67
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        klist.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
        • Size 25.6MB
        • SHA256 df9ea67529b5d6851345f3610ac1a0aafa8ed295182a8e7b30c30cb69bad48d0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ktab.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
        • Size 25.6MB
        • SHA256 6470596d42ab6f49c103b7ded16236fea482785289bed7c4cb7dfa2ee1ea7740
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        native2ascii.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
        • Size 25.6MB
        • SHA256 117c3325391c236fdb846fa3f803d078e1f94a350b7e24e91cd03af8c0ea4875
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        orbd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
        • Size 25.6MB
        • SHA256 974ace5d916877d81f33de86d211bb01ca6d853578680c7934ad75f3c772f7ea
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
        • Size 25.6MB
        • SHA256 dfb769ee10722a53d2a275237be85c82100ba0ccaadbe3836847475a68a3f7eb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmic.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
        • Size 25.6MB
        • SHA256 7b87a0dbb1edb5066a52cd5c82b83bfde0a9b9f4b8280bca2400cca011852d4c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dotnet.exe
        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 25.7MB
        • SHA256 53f4affd6237e468ffe7cb6e626f6a830989f7ddc33f9bf7c815fa76d1dc4aae
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 25.6MB
        • SHA256 0002ec6c08841e04c1e998a325a4e326297731faa3fd2f8f69908c4ca2f0765b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 25.6MB
        • SHA256 fa121fc899649dc4faf557e948a1a39eaf95e2829385bca5ac7721e03e48373f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 25.6MB
        • SHA256 f237937f687578b75a45fc05ee89d6d33ed454d68a66405b6a009f2de301de11
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        spo0lve.exe
        • Path C:\windows\SysWOW64\drivers\spo0lve.exe
        • Size 12.8MB
        • SHA256 013ed617d2c7e8e0cb283300ff09a3ec0588d9fa714c6be0db077867846eb88e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/4532-0-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download

        memory/4532-4-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download

        memory/5032-5-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download