Overview

overview

8

Static

static

3

2026-08-10...ar.exe

windows10-2004-x64

8

2026-08-10...ar.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    117s
  • max time network
    118s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260513-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    10/08/2026, 05:44

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-10_e83d38561b167dd284b640e213b5d550_amadey_cobalt-strike_elex_emotet_icedid_remcos_vidar.exe
  • Size 23.1MB
  • Sample260810-gfmacssbmb
  • SHA256 d281deac5f57be2e42bf0b3244a8339478664a9e95d482480c18550a2554a265
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
defense_evasiondiscoverypersistenceransomware

Malware Config

Signatures

  • Drops file in Drivers directory 3 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Sets desktop wallpaper using registry 2 TTPs 2 IoCs
    ransomware
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies Control Panel 4 IoCs
    defense_evasion
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-10_e83d38561b167dd284b640e213b5d550_amadey_cobalt-strike_elex_emotet_icedid_remcos_vidar.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-10_e83d38561b167dd284b640e213b5d550_amadey_cobalt-strike_elex_emotet_icedid_remcos_vidar.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:4344
  • C:\Users\Admin\AppData\Local\Temp\2026-08-10_e83d38561b167dd284b640e213b5d550_amadey_cobalt-strike_elex_emotet_icedid_remcos_vidar.exe
    C:\Users\Admin\AppData\Local\Temp/2026-08-10_e83d38561b167dd284b640e213b5d550_amadey_cobalt-strike_elex_emotet_icedid_remcos_vidar.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:4876

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        7zG.exe
        • Path C:\Program Files\7-Zip\7zG.exe
        • Size 23.8MB
        • SHA256 ea0ab19c98de5371a9dac875772596012444427220bf44d5e8bee34463d5a86b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 23.1MB
        • SHA256 a22d18a25a5eea10e65b9423c540dc7f0cf78347579cc6798e2586f97bde549b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
        • Size 23.4MB
        • SHA256 1d6d601e0e89fa350ab87f4dfa8b202b9cacc42e3e7ec03f5d1f496b7165d3d6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmiregistry.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
        • Size 23.1MB
        • SHA256 264535394e8ea7325536a0d80f19114e37e601057d2f08b21d29f06dc08904ab
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        servertool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
        • Size 42.4MB
        • SHA256 964eec4e82bfe526c272775bd8bfe887eb3f70f499239e37e2ee7ad30cb23d69
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        tnameserv.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
        • Size 38.4MB
        • SHA256 a159b792cda4cb78cc465ecc8f0509a459becb16f3577aa8a8b580f169eb4b1a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        unpack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\unpack200.exe
        • Size 40.2MB
        • SHA256 7667283623bdfab7ca8e900c6378f8001a671ced5b3e58eac8a0eb4c1f79ff4b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        wsgen.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
        • Size 37.6MB
        • SHA256 bfdbe1d061df5b5652c6586d9370231b859efada234e539c937b13e80cc47955
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe
        • Size 33.9MB
        • SHA256 c1c71e1efc06c15c8ef076c020c6e5698fbbdb4498f9de4ea430834d463d811e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe
        • Size 33.9MB
        • SHA256 8a373c30dddff78734251015390edbd6e3c8de105d9ee66eb1704ed25f313dac
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\java.exe
        • Size 31.8MB
        • SHA256 ed4eee9af66d067266a4f4839c458947f1094f338402906fad0fe61b649a10e7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javacpl.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe
        • Size 35.0MB
        • SHA256 10999596b332f749b0885e0c3eee1e1d1afe2e98a5249ce7e57b3024962537fc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaw.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe
        • Size 34.6MB
        • SHA256 baa9ba9fb6e569dc6cc3e270e74a586dfd6dd5ef9642c9ef654de4047f5270c1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe
        • Size 32.6MB
        • SHA256 f63c0bf0ed01491554d316e16b3d2710b4644c10c9ac3fd1dff35a7e71a88880
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jjs.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe
        • Size 29.9MB
        • SHA256 8e7ac371bf69ff1280f2641fa9034569b1494c9161e110f0631c2280ef7feae0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jp2launcher.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe
        • Size 32.6MB
        • SHA256 13540980b4dcfb92754cd1ca31887d6d5e83ca21fd50cf483f581bef3549722b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        keytool.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe
        • Size 29.2MB
        • SHA256 ae7ffe5606a06ad8454dbd9dc59f645e671a2acbf3921ffe936e958e9f7248af
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        kinit.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe
        • Size 30.2MB
        • SHA256 aef0a6b79225b850a0b1d28c42d4ead598833c83897df9a41f17fe7af65c6183
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        klist.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe
        • Size 33.7MB
        • SHA256 f5f90f5067f9ccb171ff3cbd53ac636171d96dbea06d7d540f827f283d324268
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ktab.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe
        • Size 30.4MB
        • SHA256 1bb1dc818b96866a7ddc1a372db82ed0df547a33d9ed9f94e6b430511d97af82
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        orbd.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe
        • Size 29.6MB
        • SHA256 c880df4037ddf53a662f1b4742bbea060e46ab055dd8b7f57a37d6fd3129e97f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pack200.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe
        • Size 31.8MB
        • SHA256 66aa909c80a70b46ecf66850197e9133cfb13faf5e2c951f67cdc8cd0b1c5858
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        policytool.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe
        • Size 28.9MB
        • SHA256 4e78062e91bb0b1b027f0a8c8bdaca1014b1759f569253b0c5266888b38a0d98
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmid.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe
        • Size 30.3MB
        • SHA256 8ef3290a9346e5d3b12713d47d804750734c2f9da1950d9e3898889ac0b92365
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmiregistry.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe
        • Size 31.2MB
        • SHA256 2f4eef662653be1da7ded98ba3652b92f7e8477eb03ff42d9b749b9f812a1401
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        servertool.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe
        • Size 28.1MB
        • SHA256 5e2612af19920394787f9ea9a6babd3f93f71f3f3a5a696118e2a52dfbb6b077
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ssvagent.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe
        • Size 28.5MB
        • SHA256 7161bd1a73cec38c3e93747b9f8d779ca7d255dfa1de8d221e2c0f1f9d1d669c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        tnameserv.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe
        • Size 29.9MB
        • SHA256 a527895958000555bf45e43a193467923a27a1327dad8ac3dd3da4b94cb1370d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        unpack200.exe
        • Path C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe
        • Size 28.9MB
        • SHA256 a9503733a5b3ab3de360573a4fd20df7ac10506744efd8f0928182c149e57666
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        fontconfig.properties.src
        • Path C:\Program Files\Java\jdk-1.8\jre\lib\fontconfig.properties.src
        • Size 27.1MB
        • SHA256 8ebca5a01898a0731835490142e76a11dae7bd1969053cca2e33db5b9c34bfb8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jre-1.8\bin\jabswitch.exe
        • Size 27.1MB
        • SHA256 77810fb21f9076a8c1f529d5a3dc892709d2625ecedad01cbf741ca6974bc09f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jre-1.8\bin\java-rmi.exe
        • Size 31.5MB
        • SHA256 489625d95bf26a8402445840f2e426a371b37f16fa8f33825133b8cbe56a3efb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jre-1.8\bin\java.exe
        • Size 26.6MB
        • SHA256 db1a0731ff740b768467b5f0b7b37c9a14cded80b64c3d35cc1ef354ccda6b1a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javacpl.exe
        • Path C:\Program Files\Java\jre-1.8\bin\javacpl.exe
        • Size 26.3MB
        • SHA256 75ae6b4a16f95a9bbe97017cc096ca682b7203198cced04962232d627d6ea41e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaw.exe
        • Path C:\Program Files\Java\jre-1.8\bin\javaw.exe
        • Size 28.4MB
        • SHA256 5ee92252379a41b90bb64488520200463f9cad66e2b9ff78a703b94918f0c9ee
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\Program Files\Java\jre-1.8\bin\javaws.exe
        • Size 27.7MB
        • SHA256 9d2e9d44d5c18130103edfc9be9b8840c0de22160af44f4e3c3e82c7c221c202
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jp2launcher.exe
        • Path C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe
        • Size 29.8MB
        • SHA256 5ffcbdc3d110dcab23332cf454350120112c86100f8f01fb4a0dd3ff3f179f99
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        keytool.exe
        • Path C:\Program Files\Java\jre-1.8\bin\keytool.exe
        • Size 26.6MB
        • SHA256 9c12ab7f1be9eb01394b47be0993639ffbc10342c8eea0fc8c063fcef0db76cc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        klist.exe
        • Path C:\Program Files\Java\jre-1.8\bin\klist.exe
        • Size 26.1MB
        • SHA256 e96ec8a146b01cdac7ce732fe78e6ab359de8e946566848eb1911c74f5fd6c6a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ktab.exe
        • Path C:\Program Files\Java\jre-1.8\bin\ktab.exe
        • Size 25.8MB
        • SHA256 abe7d7cdb017e0f578202405d29e96f0294de9d68faf0afa6cd52155c769588e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        orbd.exe
        • Path C:\Program Files\Java\jre-1.8\bin\orbd.exe
        • Size 27.6MB
        • SHA256 2750647f58c2e19a9dcb1e6fcebf0f1a32c9f15bba09c689e35416bb56407c7b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pack200.exe
        • Path C:\Program Files\Java\jre-1.8\bin\pack200.exe
        • Size 26.2MB
        • SHA256 72d4e5a98f9c9ea738bad9898241fc901b9b8a752481cf9aeb587688726825fb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        policytool.exe
        • Path C:\Program Files\Java\jre-1.8\bin\policytool.exe
        • Size 26.9MB
        • SHA256 0028d525624ad4611e43d480c72060653750020ebfe5c2c16e2c991fab5b1508
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmid.exe
        • Path C:\Program Files\Java\jre-1.8\bin\rmid.exe
        • Size 25.4MB
        • SHA256 ce9fb731fe22c2d5a014b5f9df17950a81d4302b396b59fb9094a6dee4e80823
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmiregistry.exe
        • Path C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe
        • Size 27.9MB
        • SHA256 ac7973c6757aafdf0ce4efc9a201549c442bb98569a21ccdec1c1a54eddf82e2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ssvagent.exe
        • Path C:\Program Files\Java\jre-1.8\bin\ssvagent.exe
        • Size 27.4MB
        • SHA256 42b0ab05534da640a95591e0180b5652c6892c955ccff975d1fd04ef42dc9267
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        tnameserv.exe
        • Path C:\Program Files\Java\jre-1.8\bin\tnameserv.exe
        • Size 25.6MB
        • SHA256 2c211af06f381449f81575ef79ec7ed4cced373bd2ebec49bb2add75bc675552
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        unpack200.exe
        • Path C:\Program Files\Java\jre-1.8\bin\unpack200.exe
        • Size 25.1MB
        • SHA256 4bbb026bb707cd53f6113d7bbcd629bceb74ebb46ba35fe73822bae951848c13
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        AppVDllSurrogate32.exe
        • Path C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate32.exe
        • Size 18.1MB
        • SHA256 14cf9dd7d034a880378d5fd9f25076e4355dc792cf10132dfd4369e3dd14cc81
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        AppVDllSurrogate64.exe
        • Path C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate64.exe
        • Size 25.1MB
        • SHA256 4cf616395d7ef5c6e10dbbba85ccf4a78eef0a29a6a723378232e0c2e01bcfc8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        AppVLP.exe
        • Path C:\Program Files\Microsoft Office\root\Client\AppVLP.exe
        • Size 24.7MB
        • SHA256 3cfb29c687842e4b304426a6c36c8c5bee5be9bd70cf3515f37464f8167e2749
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        OneDriveSetup.exe
        • Path C:\Program Files\Microsoft Office\root\Integration\Addons\OneDriveSetup.exe
        • Size 23.4MB
        • SHA256 34f5df9e41d5dd1c5b9e72fbe72b347a125510287c224217a29d38f7524b2882
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Integrator.exe
        • Path C:\Program Files\Microsoft Office\root\Integration\Integrator.exe
        • Size 25.9MB
        • SHA256 9cab0f09f52adfccfa37d52bdf2454a3f348b814c02ee442f1ab2a095bb75f87
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Microsoft.Mashup.Container.Loader.exe
        • Path C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.Loader.exe
        • Size 23.3MB
        • SHA256 cd74947aab9b689f706f00bb550d23ef3a16d07b258c30804067c34bffa822b3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Microsoft.Mashup.Container.exe
        • Path C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.exe
        • Size 24.5MB
        • SHA256 0e7f466d02e12400820f61b66111d6715206d1d33120c876c9f9bdc1090e0c10
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 23.2MB
        • SHA256 76db69d5b41d9b77e02d8f28cbad505928439f14d6503a454b5c6bc48e1f6ce1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        spo0lve.exe
        • Path C:\windows\SysWOW64\drivers\spo0lve.exe
        • Size 23.1MB
        • SHA256 d281deac5f57be2e42bf0b3244a8339478664a9e95d482480c18550a2554a265
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download