Overview

overview

8

Static

static

3

2026-08-10...ar.exe

windows10-2004-x64

8

2026-08-10...ar.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    70s
  • max time network
    134s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260513-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    10/08/2026, 13:45

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-10_758b9ea1a90abf3a2f5e2457231afd16_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
  • Size 18.6MB
  • Sample260810-q2stpsam4v
  • SHA256 52f480f8559fd4e329e15b74cdb1c54c3a7a94fbc7253bd5711d07d65fe1088a
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
discoverypersistence

Malware Config

Signatures

  • Drops file in Drivers directory 3 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-10_758b9ea1a90abf3a2f5e2457231afd16_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-10_758b9ea1a90abf3a2f5e2457231afd16_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:3092
  • C:\Users\Admin\AppData\Local\Temp\2026-08-10_758b9ea1a90abf3a2f5e2457231afd16_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
    C:\Users\Admin\AppData\Local\Temp/2026-08-10_758b9ea1a90abf3a2f5e2457231afd16_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:1184

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        7zG.exe
        • Path C:\Program Files\7-Zip\7zG.exe
        • Size 19.3MB
        • SHA256 1e91b064dd47ffbaa4913e46da78eb8ff785f8ce9f12f724ccd2811b8fda14ca
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        IntegratedOffice.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
        • Size 22.7MB
        • SHA256 c22acf0ab7775c626bbca0a9323fe895a22163928a3c3a41969f165f43b04a3d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VSTOInstaller.exe
        • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
        • Size 18.7MB
        • SHA256 eac2a556ddf7bfe60045ee7b589c442dc657ed0a77cf78dec3218510b3fcf6d4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrmstp.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        • Size 43.2MB
        • SHA256 dbd4e17916951171fa81edaf9cf020902a7169f001b31ffe22f02816ed59f778
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_pwa_launcher.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 38.9MB
        • SHA256 3bff3358a60c274453127976f15cabc7d4e3c64f3299cd87f62b7dcc456864bf
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 39.4MB
        • SHA256 c51966973678945d3c511f3a62f9a56b798df932b30d9d1e90db17a224be6328
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notification_helper.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 38.8MB
        • SHA256 348211987f1ef39eddad64f7a9b1140db1ae38452342cc67c377fd20c2387ebb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        os_update_handler.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 39.0MB
        • SHA256 b5ae30e964bf41f4f14721c73500e508ba0ea44cb1bf94faa41db2c1ecda2e92
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 40.2MB
        • SHA256 b54a787430a315fc7276c1a2666fde71c4ad06d4dd88c6bb7b4c0fd34da3cbd3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_proxy.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 38.6MB
        • SHA256 3b06c66eb38c51092b5fcfdbefb25f41eda9feeb2d411591c7e39f4234440548
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 37.2MB
        • SHA256 8fce00e7d8ae16203070af62797ee6e922537855ad546da720038aa7659b261e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 37.2MB
        • SHA256 66e2e76a1440b5eb03d6f14ee2314371f8f5d1b727db24669cc1e46fe6aecd9d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 37.2MB
        • SHA256 9092b56819461a888a702f2dd5d4dd62d8cfefbff0634f3e94c28b2b2f04ccc0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jar.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 37.2MB
        • SHA256 e606fb2e29fb0dd3b7865562740e57141281e0386d9bd80c7e961012bf7d2d0d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 37.2MB
        • SHA256 e5c683666b1a2cf03808472551b8e4d76e8e7fe81b15c0f314f64f0a6bf72de7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
        • Size 33.9MB
        • SHA256 dd56a722e4dde1176bff1a5c118177b6d9ea6c526563db3b2037b6c784d497d7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javadoc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
        • Size 37.2MB
        • SHA256 8bbe8274686e5aef657b0591a19a67e2ee7c8ef103c3d46346e719bcd06b067f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javafxpackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
        • Size 29.6MB
        • SHA256 bfaeb1c090a84d79b4c3d61590d9a6b619d1d84f079bc2acb81aa6b3a8d9a968
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javah.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
        • Size 29.3MB
        • SHA256 2940fb4010bfe4cd1221d290962798e32d3d6d38902895564a13c952d781de16
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
        • Size 29.2MB
        • SHA256 8b1eae5cebfee7b3af5571902a3b4a88216ac3c204283155b850bf936496cd02
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javapackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
        • Size 29.1MB
        • SHA256 d943b9afc5ef9834d715e067c80c4773449a832d1c1f9b8eb8effc09c74ac373
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaw.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
        • Size 29.0MB
        • SHA256 0be8d531f1dac4dc12df26c495e9a98001f99dbe627cc62079ff6bbc80f69683
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
        • Size 28.9MB
        • SHA256 e6fe514b043831bc330d6de99ac2e46bd92b13708d83be06598c23f22a46da2f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jcmd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
        • Size 28.9MB
        • SHA256 9380c96431c698262e9b84a217812ea6b2ac051df80780ba0a6b373cf269c2bf
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jconsole.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
        • Size 28.7MB
        • SHA256 8be861530e510ff31d1e87346e8018a1a9422429be2c248bb44ec09b80b94b58
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdb.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
        • Size 28.6MB
        • SHA256 99a66459d4b29c892de61570a202ffcd1283c6902f914b814c0dc6b8d05ecbd4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdeps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
        • Size 28.4MB
        • SHA256 81bb827478c9506e75fc6be3b3cb064c4ff8545ec66a402f84677fc740c56a85
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jhat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
        • Size 28.2MB
        • SHA256 10a63ced0c06bd71f7acffdd16ad07d8dc6efc1239d25763e217fe4da779ea6a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jinfo.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
        • Size 28.1MB
        • SHA256 602a20b2dfd5d09f38b2b2eec1e432615b4354f0b1db2b15e257a9ba90e89e65
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jjs.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
        • Size 28.1MB
        • SHA256 f59a9a07f01b1455ae2931f995cd3a86f0a2ad2296dc955bf42ee7fd4b7cca07
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jmap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
        • Size 27.9MB
        • SHA256 be3cf8327ff8810e251df95cda1b015e2fe65bfb4b8bdd5db11805ad14ed2283
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
        • Size 28.3MB
        • SHA256 df1af4575b2a9607c82304e583255c8212dd3bdf82ab1afba504f03d81c6a323
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jrunscript.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
        • Size 27.9MB
        • SHA256 d0276bf8d4085f24da905ac0970cc5be68dc0f8fbb9f1db92e0bac30c1028442
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jsadebugd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
        • Size 27.8MB
        • SHA256 cf164b95311b13952bc558c3cdf0390d34ddea8986295f1293204749adc3496a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstack.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
        • Size 27.8MB
        • SHA256 084e312477aa4cd3f81d392f863b716d9c262e4d5d3af9c3ccd84da8e31e80e6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
        • Size 27.6MB
        • SHA256 91694797993bf8b36fe09fe5399007f3c4deb20fdbce4d4c8dc301d2bff04d9b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstatd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
        • Size 27.6MB
        • SHA256 264b94e18a34700e7b9b91e4517cf0eb0c4488b6d8171af58750ba4403e32eab
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        keytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
        • Size 27.5MB
        • SHA256 d1a5996abccb2c09f41f6b8eea54882e0dbf7e333c25a630cf98216d9c550761
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        klist.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
        • Size 27.4MB
        • SHA256 d74dc552aa870925a442b77fc940feecf3ae6480608166dce73651a56ff83a84
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        native2ascii.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
        • Size 27.2MB
        • SHA256 c1df0d2aa37692ff2476e780ad684d016281f22b0d40ffe3647e185ed6d6a854
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        orbd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
        • Size 27.1MB
        • SHA256 ad28d9c4679a69397c0753fd72103d071416bfe429ec33d88e2f0cf55391c8bf
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
        • Size 27.1MB
        • SHA256 e6f2a3f7496e0888ece5217e2d77deb8eebf4c197395b1185459a7c90e5dad88
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        policytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
        • Size 27.0MB
        • SHA256 085c243e94ee09a201e9e6bde8029b5e1836c5f9550f478bd4714aecde7d2593
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmic.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
        • Size 27.1MB
        • SHA256 74a50cc693988930f9e47d1330340c8ec00ef2ceef59fee9e9f2abeee695e9ab
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        serialver.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
        • Size 26.9MB
        • SHA256 3af013a06311b7c8de901cae1e02523c1da6198d3afa6656f5d163711d69e7b3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        unpack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\unpack200.exe
        • Size 26.8MB
        • SHA256 26b3959199b0eee15d26edbb61c2b58776a7a910edd13d1fa40eb185e471231e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 37.2MB
        • SHA256 f743d31f5038f8850cdaa1137555e1d7d3904627e19763a087c6a002712e3080
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 37.2MB
        • SHA256 ae32662cd3bb545513a67e1e0306ececd4ef16ba83edadfc8898465872591b73
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        spo0lve.exe
        • Path C:\windows\SysWOW64\drivers\spo0lve.exe
        • Size 18.6MB
        • SHA256 52f480f8559fd4e329e15b74cdb1c54c3a7a94fbc7253bd5711d07d65fe1088a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/1184-6-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download

        memory/1184-2-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download

        memory/3092-5-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download

        memory/3092-0-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download