Overview

overview

8

Static

static

3

2026-08-09...ar.exe

windows10-2004-x64

8

2026-08-09...ar.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    150s
  • max time network
    143s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    09/08/2026, 16:26

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-09_86dd5be111015bede0d71be2c5dbf536_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
  • Size 12.8MB
  • Sample260809-txm97shr9w
  • SHA256 013ed617d2c7e8e0cb283300ff09a3ec0588d9fa714c6be0db077867846eb88e
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
defense_evasiondiscoverypersistenceransomware

Malware Config

Signatures

  • Drops file in Drivers directory 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Sets desktop wallpaper using registry 2 TTPs 2 IoCs
    ransomware
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies Control Panel 4 IoCs
    defense_evasion
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-09_86dd5be111015bede0d71be2c5dbf536_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-09_86dd5be111015bede0d71be2c5dbf536_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:4128
  • C:\Users\Admin\AppData\Local\Temp\2026-08-09_86dd5be111015bede0d71be2c5dbf536_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
    C:\Users\Admin\AppData\Local\Temp/2026-08-09_86dd5be111015bede0d71be2c5dbf536_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:5492

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        7zG.exe
        • Path C:\Program Files\7-Zip\7zG.exe
        • Size 13.4MB
        • SHA256 b4a365ff3a9f006c8742afe355c703f6cb7e664573f9bbb3729906bdee71682e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Uninstall.exe
        • Path C:\Program Files\7-Zip\Uninstall.exe
        • Size 12.8MB
        • SHA256 798ac496b5b0c5aba04eebbeaff91a996d6d26eebc4884e656f2547896bcdf51
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        AppVShNotify.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
        • Size 25.8MB
        • SHA256 1d937d7bb3b527c8569707f181e69f1ab204e0985ddc6aeb916c7592b1d00b72
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        InspectorOfficeGadget.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
        • Size 25.6MB
        • SHA256 dfecad240c21e5a8f97bae187934d03b3c76d924d87015a3c39c4c2f3e5fba69
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        IntegratedOffice.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
        • Size 29.6MB
        • SHA256 488da8fec298b9fc662c19b22789ef7b981b07b576a90040c6cb3d7dfba0f9fe
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MavInject32.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
        • Size 25.9MB
        • SHA256 da31fbd4a2458d86015489d7bdbc2f609db387ce150aa780d80cba32f68abcc1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        OfficeC2RClient.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
        • Size 49.0MB
        • SHA256 b4a9d1115ba5f3550affe9ef9a267523da1105a3ed710abc23ef86dac611b09d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appvcleaner.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
        • Size 27.7MB
        • SHA256 9ad1fec748a64b62ea0720643be92873f5ff4f78bb35aecef92e6432d0aca6c8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notification_helper.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 27.2MB
        • SHA256 31e0f75def68b95d17be0f389b6e3daddb1da2b36e808fbe2ad65bbd71730188
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 28.6MB
        • SHA256 cf3f7a2c5327013d2644657bf9996e4962cffa3a2df6a91e7f08cfe793a3fd2c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 12.8MB
        • SHA256 83b06631fc1860f17826d4d0dd0944345695bfffc982db9c4135f84939a04ebf
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 25.6MB
        • SHA256 0e7c03159fadd3429a9ad3a46321fe8afa36c1ca7ff1016648f03e88d474eac7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 25.6MB
        • SHA256 1f59adcac2018f1f347fa74906e7b70eb985abc1a42176463f023b813997543b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jar.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 25.6MB
        • SHA256 af2fb569c83b9a3ed82a7dba3097750615052655cc8cac38c50b9c5d665c8e82
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jarsigner.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        • Size 25.6MB
        • SHA256 3d7e6103bc7c520d651a0247be466354b067fba13c06549a96b80d88c701b565
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 25.6MB
        • SHA256 1b867dbb7088534c0fdc47f754ab511d5f57757e54468209e8e9833539717452
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
        • Size 25.8MB
        • SHA256 ab662e43bd342fe019f6740fac3766131ba94f52876878721081d4c0caf43409
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javac.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
        • Size 25.6MB
        • SHA256 894b6e087fdb642e9cc23fad2a273a2edfe69d4e6c81c59e0b7cf7a96484b4ec
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javadoc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
        • Size 25.6MB
        • SHA256 60231b7f4b383126918c265dc763b7ef12d4150ad9ad1160db2af8b270cf4996
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javah.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
        • Size 25.6MB
        • SHA256 a26c6d0e520b53c6fceedd8944232ed0fdbd5b56a540b1da80fc21dedd0120f1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javapackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
        • Size 25.7MB
        • SHA256 09171cf8807441e5bcefdcb49ab4da666e6595835ffefdd1a741aecbfa10d0f9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaw.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
        • Size 25.8MB
        • SHA256 7d52568004fbc2a181bd7efa603704d84e7353f03db334463748fe244e0bab1d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
        • Size 26.0MB
        • SHA256 b633a8910a7d07f0dcb70bbf85eefa2c1978647e02ecd39c25a89319e51d09a7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jcmd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
        • Size 25.6MB
        • SHA256 2021d63a436f3b0a611e36dcd8913edda019ee40190a2d2f21134b271fb2f035
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jconsole.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
        • Size 25.6MB
        • SHA256 4889cad8a15dab29830b77d73d45b9192a98b6546e6f6c2d01ae4b5802f837c9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdb.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
        • Size 25.6MB
        • SHA256 73e88ffb9268c3b077310a9e3414451e3b9cab3c1c585f4578b85255eea46c86
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdeps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
        • Size 25.6MB
        • SHA256 5cc2e15c2c179b27fdd538bdce5637510aa3cbea99c20656ca963c82293be040
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jhat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
        • Size 25.6MB
        • SHA256 1ac38ac2e9d253b14046f385a6fa64e8962a874db7a82e07977dd371be18cea3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jinfo.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
        • Size 25.6MB
        • SHA256 39a82d855a2f521b86fe87ca871cd64f7222bfa7e61599f0bf55fe6683b1190c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jjs.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
        • Size 25.6MB
        • SHA256 e2dbf7a6b431d29fbec09023c2de55b561320489bd6f819572f952e3ab8e1812
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jmap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
        • Size 25.6MB
        • SHA256 70e4f1bc6dad448d06ac41af5c6ab661cf846534097523adac54bd8404861bb7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
        • Size 25.6MB
        • SHA256 67954cf9e0ebb8a59eea2e810390e188b86faa4f4b4541be13708771b0dfacaf
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jrunscript.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
        • Size 25.6MB
        • SHA256 20426d14e140323d4db4fb6c27c1594f95b8716b036de30c4ce008579ddf61b1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jsadebugd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
        • Size 25.6MB
        • SHA256 d6a2af033b48a1cc071a34c518361a6f1605e4f470484f76011bee3129821013
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstack.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
        • Size 25.6MB
        • SHA256 b98d506345d134e5a6aa0f269f60b50885b26b4a4ff349c4d309d709144b5df3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
        • Size 25.6MB
        • SHA256 103cf83e63990361eb864eb729c5c09bc6a0dd1a2633a2ce323518fa5d019ea0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstatd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
        • Size 25.6MB
        • SHA256 3ec2593bc3e3cde53365058b714b5dd7e927b453d744c61c6a1a05b03d0b0f0d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        keytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
        • Size 25.6MB
        • SHA256 09856742a1150bc5165c8c8668bb19642511b66ae1b8ee5e9bc56abb9a2c676e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        kinit.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
        • Size 25.6MB
        • SHA256 bc38291e9d422f8b8071f3f99c9a7c33d48737ccca96f976ec61f496be3b3e67
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        klist.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
        • Size 25.6MB
        • SHA256 df9ea67529b5d6851345f3610ac1a0aafa8ed295182a8e7b30c30cb69bad48d0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ktab.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
        • Size 25.6MB
        • SHA256 6470596d42ab6f49c103b7ded16236fea482785289bed7c4cb7dfa2ee1ea7740
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        native2ascii.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
        • Size 25.6MB
        • SHA256 117c3325391c236fdb846fa3f803d078e1f94a350b7e24e91cd03af8c0ea4875
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        orbd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
        • Size 25.6MB
        • SHA256 974ace5d916877d81f33de86d211bb01ca6d853578680c7934ad75f3c772f7ea
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
        • Size 25.6MB
        • SHA256 dfb769ee10722a53d2a275237be85c82100ba0ccaadbe3836847475a68a3f7eb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        policytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
        • Size 25.6MB
        • SHA256 5a12777772dadbdb93127cfef97d14aec4066ab44b73380dd7251c807585835e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmic.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
        • Size 25.6MB
        • SHA256 7b87a0dbb1edb5066a52cd5c82b83bfde0a9b9f4b8280bca2400cca011852d4c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmid.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
        • Size 25.6MB
        • SHA256 4cdb90b26858584709ab80ba8ebf9c3a5e2cd6921e4c09a8e29989cc78cd4fd3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmiregistry.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
        • Size 25.6MB
        • SHA256 52ed3777b89fe2e56e36f92b7139b8222c1a9cc55d5deca1dd15c1ae54bc4b66
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        schemagen.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
        • Size 25.6MB
        • SHA256 5b96dafc7ca720636256c3579eff09d6eb9162ff1952c035b76bda6416d221e1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        serialver.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
        • Size 25.6MB
        • SHA256 ca7e5934f8442a1dd77b40cab14c2039755ab70eb06ee71467ea33f40bf85ebc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dotnet.exe
        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 25.7MB
        • SHA256 53f4affd6237e468ffe7cb6e626f6a830989f7ddc33f9bf7c815fa76d1dc4aae
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/4128-0-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download

        memory/4128-1-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download

        memory/5492-2-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download