Overview

overview

8

Static

static

3

2026-08-10...ar.exe

windows10-2004-x64

8

2026-08-10...ar.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    56s
  • max time network
    135s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    10/08/2026, 05:44

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-10_e83d38561b167dd284b640e213b5d550_amadey_cobalt-strike_elex_emotet_icedid_remcos_vidar.exe
  • Size 23.1MB
  • Sample260810-gfmacssbmb
  • SHA256 d281deac5f57be2e42bf0b3244a8339478664a9e95d482480c18550a2554a265
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
discoverypersistence

Malware Config

Signatures

  • Drops file in Drivers directory 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-10_e83d38561b167dd284b640e213b5d550_amadey_cobalt-strike_elex_emotet_icedid_remcos_vidar.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-10_e83d38561b167dd284b640e213b5d550_amadey_cobalt-strike_elex_emotet_icedid_remcos_vidar.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:2028
  • C:\Users\Admin\AppData\Local\Temp\2026-08-10_e83d38561b167dd284b640e213b5d550_amadey_cobalt-strike_elex_emotet_icedid_remcos_vidar.exe
    C:\Users\Admin\AppData\Local\Temp/2026-08-10_e83d38561b167dd284b640e213b5d550_amadey_cobalt-strike_elex_emotet_icedid_remcos_vidar.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:680

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        AppVShNotify.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
        • Size 23.4MB
        • SHA256 0e697cc0af2ac108724c67d5ce29bc085fbfe96959c452d063dc1173c581dd66
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        InspectorOfficeGadget.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
        • Size 46.3MB
        • SHA256 b04de96d5ceea019f918ca4bd45927b05a1b3c9562388dbcc590ba75c2fa2351
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        IntegratedOffice.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
        • Size 50.3MB
        • SHA256 75b9dca36c86e47c1b1406a7433fe8d3099216ac3bfc47d62101f565c61e0e87
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MavInject32.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
        • Size 46.6MB
        • SHA256 dfa7d4d3d3bf0bcb4d536dcf6cadf4fa4736edc43415ebd7f241ede7672fcb4c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        OfficeC2RClient.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
        • Size 53.9MB
        • SHA256 09ecf04dd942deda7b1e9d6421a403d18cfaa99ba40e5bd4a9cc5157be84c84e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appvcleaner.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
        • Size 25.2MB
        • SHA256 24addf20e777a864457a5cdb0077babbe3a5c581e557768d715ca1263a0af210
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VSTOInstaller.exe
        • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
        • Size 45.6MB
        • SHA256 748a0dbc6cb858250776926ec4a14f4f700306eef913a6570b70c0fb59d52b87
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrmstp.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        • Size 41.0MB
        • SHA256 a96006e24b5a0a60f3b32d2bc596565f4798e80e31563560da4e76c45c8a6a66
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        setup.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
        • Size 41.7MB
        • SHA256 aa271e95e21203a33708e2c4910dc1536b8ad00efef7e4292e38b88449a192a8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 25.4MB
        • SHA256 bcec42c56ab2405676c9906ea5e7548311629496fcc63a479d2b6814ee252e1d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notification_helper.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 40.6MB
        • SHA256 843689cfaf81155aa756e7ef340a5d47e35f02dd45b0dbe132ed14f7e6cb0efc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        os_update_handler.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 38.2MB
        • SHA256 48ca285f80165d683000471bdf13da095a73e19b0b44d1c35128574a85598a81
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 39.8MB
        • SHA256 8f45b198e63622909e39cb454c15ea6d579a5c3cb42bc2d7fb7921f037125d9d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 38.3MB
        • SHA256 620a579f66f811d723d2ca186cb892eea768433ab9834c79289fc40da9d0e720
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 38.1MB
        • SHA256 095df41886c5d96e913e87f481f65bf21b6d9dbdbcf38c226a150f31597ee484
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jar.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 37.0MB
        • SHA256 bcb9f2fbdf9e1176eb14f9d0ec14c5a430fb63a6df8ed1923b8391fc0215069b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jarsigner.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        • Size 36.1MB
        • SHA256 458b47bb30058a66360a8e8731b4627d6ef028199f9e212836b1364370551495
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 35.6MB
        • SHA256 12c8c9fa8ecdcf412bf718e753d53ff78c136abb49d2fbd5d234d4aae342dad2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
        • Size 34.7MB
        • SHA256 16266de59dc4001429b63fd3e453934428b56a12b9633454f26d1d2126370477
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javac.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
        • Size 37.2MB
        • SHA256 fba530bf515d558d474b0184b52995241d18934b7417f6f3b8ae3ced4bf0569e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javadoc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
        • Size 34.1MB
        • SHA256 0cdccc428562669a557a6f54320ed3964e3f9d2e20c675e1e054a409e95e11d1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaw.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
        • Size 36.3MB
        • SHA256 3cc25f304f36c9ab80adc2c8ebafe6a945a2ee75bc8be59172b58dafdc21efb2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
        • Size 33.5MB
        • SHA256 8e4f845a53aaf740173e55e5ed93386d2725e86ecb6c6b70a558202e590a33d6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jcmd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
        • Size 34.8MB
        • SHA256 cf86728db7cf2a35aa4d334e2afe54eae01c2cbc9629d6f958077b4535bd6f55
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jconsole.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
        • Size 35.2MB
        • SHA256 bdf447d3fbb59d1b2c534bac41a1218938123890d5a63b13a1ebc1b8bf291d2a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdb.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
        • Size 34.0MB
        • SHA256 f7f9b48db3b2a8b997e4e940a13622a47943f1b2280a51ecf3600fba88fbc1fe
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdeps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
        • Size 32.8MB
        • SHA256 825630fe0fdaa70c3a8eca8d596145b30fe50063b8fccbab1e8f60fc4bebbc1d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jhat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
        • Size 33.6MB
        • SHA256 8b0fc87d91b402b9ebbd98c0b76677c18be65c08ee4b9877095fae544e56e7b6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jinfo.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
        • Size 33.1MB
        • SHA256 3db9725935f3630174cf42b567e12a3b0e778809a16351f056d7453ff4b68c09
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jjs.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
        • Size 34.6MB
        • SHA256 baa9ba9fb6e569dc6cc3e270e74a586dfd6dd5ef9642c9ef654de4047f5270c1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jmap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
        • Size 31.8MB
        • SHA256 66aa909c80a70b46ecf66850197e9133cfb13faf5e2c951f67cdc8cd0b1c5858
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jrunscript.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
        • Size 36.2MB
        • SHA256 eec9c962d7ec6ddfc2c64cdc74f395ef120cbec08e2d3acaafff51609ac947a0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jsadebugd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
        • Size 35.8MB
        • SHA256 63ce22ed7e116d1f4e5a51edc6f5e7ecdbe706a9213cde3304627d23f6b5f8e1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstack.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
        • Size 32.1MB
        • SHA256 e67f0d5e9ca6723c3c753c7dee905cedd3885ae07ddbf12b17ee5e13208a966c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
        • Size 34.8MB
        • SHA256 b4646f10326149c57b6e7206db17c0bd8b7b1a4cc1bc93ee7a552e841afd0904
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstatd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
        • Size 32.4MB
        • SHA256 4f7f1f22a765e1fe9022191b47e8c29c54f990dccb75175c2c9c765cb6f43eaf
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        kinit.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
        • Size 23.1MB
        • SHA256 b3a2d36d2a20745f385fe361dc4ad78502da134aae170a1dd5c3d9b54d3eb174
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        klist.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
        • Size 31.6MB
        • SHA256 58ebb11436dfb5fdeabe792550ec8c740d7bed7b53a3f854074501004d3c3201
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        native2ascii.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
        • Size 32.2MB
        • SHA256 33a1325bbf2aac11df2a5f39a60349d4469ed830f67fe4c45ed07d88885fb6d2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
        • Size 30.7MB
        • SHA256 2ff4af65bcb5c6f52473ad53f73d3fd32ac60a448197629e0151317de17e57ee
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        policytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
        • Size 31.2MB
        • SHA256 2f4eef662653be1da7ded98ba3652b92f7e8477eb03ff42d9b749b9f812a1401
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmic.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
        • Size 31.6MB
        • SHA256 753ac0103f1177fdd8a89015f3068276ed1704f77471b9e9142b34ec28ea664c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmid.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
        • Size 30.9MB
        • SHA256 798c3675f2254b24889472961152f92921fd08a56148454dfa717b8b67063496
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmiregistry.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
        • Size 31.7MB
        • SHA256 9d4d049cdba54e734c15e033ee1811956ad71c86397aeb4796653262f0618044
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        schemagen.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
        • Size 33.2MB
        • SHA256 c09f19f49f2a3f14a8ae0083d7e3f4f92bd017da5b5f646debdfa2e41e95be5d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        serialver.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
        • Size 30.2MB
        • SHA256 aef0a6b79225b850a0b1d28c42d4ead598833c83897df9a41f17fe7af65c6183
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 45.2MB
        • SHA256 377b8edc949561b73c941416f05da861012c6aaed46d3bbebf9fadeca8a0351f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 44.2MB
        • SHA256 a0b87f4e228891dcfe4db953e86af73da51e13ab78585da9623405da2d1a8994
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 43.4MB
        • SHA256 f2043a96b0f2e483311cb6dd6b04e029e042db71c196b15a2454049e8867c075
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download