Overview

overview

8

Static

static

3

2026-08-15...ar.exe

windows10-2004-x64

8

2026-08-15...ar.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    149s
  • max time network
    127s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    15/08/2026, 09:25

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-15_5c7a7e719e28f2806ee8c5d9f9a65644_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
  • Size 13.0MB
  • Sample260815-ldws8starb
  • SHA256 9d6c2bd6e54ad03749da9e2609d3a1f14631ec43782b8fa215777986c7903443
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
defense_evasiondiscoverypersistenceransomware

Malware Config

Signatures

  • Drops file in Drivers directory 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Sets desktop wallpaper using registry 2 TTPs 2 IoCs
    ransomware
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies Control Panel 4 IoCs
    defense_evasion
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-15_5c7a7e719e28f2806ee8c5d9f9a65644_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-15_5c7a7e719e28f2806ee8c5d9f9a65644_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:3732
  • C:\Users\Admin\AppData\Local\Temp\2026-08-15_5c7a7e719e28f2806ee8c5d9f9a65644_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
    C:\Users\Admin\AppData\Local\Temp/2026-08-15_5c7a7e719e28f2806ee8c5d9f9a65644_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:1712

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        InspectorOfficeGadget.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
        • Size 26.0MB
        • SHA256 2baf2e22122bb76f9766355ea0b452f699332a25a06ff6e6e3b250d71618defb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        IntegratedOffice.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
        • Size 30.1MB
        • SHA256 6554bcf1b06f4cbe50f649fc54135a5b4817c15d55cee204f2f94aa8a3156ad1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MavInject32.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
        • Size 26.3MB
        • SHA256 65f869b543b42beb699de75f93bb8e81d8a6290bc24cbee750176d9888f8eae9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        OfficeC2RClient.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
        • Size 49.4MB
        • SHA256 5546d289c71a7b187d7b1a19544fe5547b981ca0db5c55ca7931074595da14a0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appvcleaner.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
        • Size 15.1MB
        • SHA256 bb434d51b6c5c4f8835ec0ba2a5ba5b651ae88b62fc110ba37ca57584a63b981
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VSTOInstaller.exe
        • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
        • Size 26.1MB
        • SHA256 322c7821a222362fb42d863c62aec5eb551bc03e2196aef95613551d8b0d937a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrmstp.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        • Size 32.0MB
        • SHA256 b7936aff35bb7b618e7faf8c61e1f0f096c75295ae728d0aff4a232e1757631d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_pwa_launcher.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 27.7MB
        • SHA256 5b52a050e61f4768a3a9cfb16188d43def370b2ce0fcf5a45f04c725be0f71f1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevated_tracing_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 29.4MB
        • SHA256 aa3e0360a2898afabd5ae6223f7713639f875d966d8c79ef88104fa26cfbadbb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 28.2MB
        • SHA256 5065afe73fac3f8879217ab19e5424262b8270ea1bee8ddc239ffd1b3c33a734
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        os_update_handler.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 27.8MB
        • SHA256 cd833fa2b7f35930379a5991290f44619851670d5e5e82aeea78ba199df210d2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 26.0MB
        • SHA256 e70c35f7ff16ba78422386c59b841f8b275eb3c666c2a50060b4dd208e25e390
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 26.0MB
        • SHA256 4d89df961a0295bf02a17eaf273f02debd6b7d016742d63f2e8a86d68a6c0e33
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 26.0MB
        • SHA256 99b6ac7fd6ec21967df4c1725f60e79eda1f5de2ae054c71d06d3c8c0ff52d88
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 26.0MB
        • SHA256 8a20d3dde28bc2f74dfca89f020033374a662846d976f9f7afebf7b87f4e0c09
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jar.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 26.0MB
        • SHA256 e0861c09bd4bd21796f1a6bdb7bedf176dbc23dd023ba8ac15a288346cb3303b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jarsigner.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        • Size 26.0MB
        • SHA256 ac5d4c93136a4035479de21e4f4dcf8c299b98df572e52a01061c6ac3f6354e0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 26.0MB
        • SHA256 23c52f5160e51d14950456f2ada9bbbd030dc7c1d8cdd31ea9bac05ddb3fd17a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
        • Size 26.2MB
        • SHA256 6307f26e49533fe0f3b073a95794c2cdce0ee3a44b74b87ef3083baf89cd85e9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javac.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
        • Size 26.0MB
        • SHA256 1d6452e03e0872109bc62b0e4e0b923c405ed21c0b674f534ce9f511fa3f0c89
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javafxpackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
        • Size 26.1MB
        • SHA256 4f300f969b5caf21b2d5c88510a60ae52d73e5e5c587917ebc4919ec50a4fb86
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javah.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
        • Size 26.0MB
        • SHA256 1722145551f1b07e9c8d4ca21473d309cd2acac9ecdc5d6910bc3be28a45b558
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
        • Size 26.0MB
        • SHA256 e8c3b11c2f1a32f6e78c3c5b20ced9d1db5226282490986462d9a63c10245d46
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javapackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
        • Size 26.1MB
        • SHA256 883bafaefe6fcde81c9c84d82afa4029ea85fd9797a10624f6d010d44c967799
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaw.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
        • Size 26.2MB
        • SHA256 cc278c1dd221c026b351dd0bc729d2d56e579e56e5960ea0e7717f1aaad9beef
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
        • Size 26.4MB
        • SHA256 7e151c58efdc93395a8dffd7c138c6a2ed32b53e47fbc0e768070ecf9802052c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jcmd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
        • Size 26.0MB
        • SHA256 a5dec853b60133daf481b1ffb2619feeb5abae344ee7c8d86e4bf5229337903b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jconsole.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
        • Size 26.0MB
        • SHA256 b32f3b692667c05f81f90d5bc91d0df46e7b4c2d862a2b0d483475c829eaa3b4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdb.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
        • Size 26.0MB
        • SHA256 6b27e6bd9ff135d12e2a6957ce58d9f959bd83d21703e1994fc86d9065d17c30
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdeps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
        • Size 26.0MB
        • SHA256 481c664bf42f0cbfa10c1b5c6d820cbf67b79b59dcf753e335f1e380db0cf390
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jhat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
        • Size 26.0MB
        • SHA256 74c731289d53781ce08e9288880363670893802f9e1d8d8497a6e92d7e83ce3a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jjs.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
        • Size 26.0MB
        • SHA256 e486e3a4ab93e86e66e6c1c40719d6bd97ccfd05dc42194bb3801f337ebbc3b1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jmap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
        • Size 26.0MB
        • SHA256 1afa086cff5aa76a30e084730ff9f3bb399b4ce008a8ee9024c82f885e65a024
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
        • Size 26.0MB
        • SHA256 296f64d400e9ae34c1164665ecab236d08b71977bd777cd621e0fae5128f020c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jrunscript.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
        • Size 26.0MB
        • SHA256 033eea3bc4241090c5c359e41251d0be87e903c6522f9b5120af57d2ed1e0d83
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jsadebugd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
        • Size 26.0MB
        • SHA256 56dea98e3486534e909302d3f22afb4ef4ca6aeaf23afc133d1dae30d0b0c4b8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstack.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
        • Size 26.0MB
        • SHA256 293323909892a6fcf3fff7eec13044f79dc61b9cf1dc8357acef7e2ea0d46cae
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstatd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
        • Size 26.0MB
        • SHA256 2af146d129ad0e322e6b477c7e332afacd52b2cddfeff94f0edbc03c39aecd78
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        keytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
        • Size 26.0MB
        • SHA256 ae8f3f24aea5c45425b32feb85628fa88ef49a050e4f1717d4acb61f370b5bfa
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        kinit.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
        • Size 26.0MB
        • SHA256 1d1532106332cc3c7a478c8ac3ef8445ec1328340b37b23fb22976e5d4882f9a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        klist.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
        • Size 26.0MB
        • SHA256 3db5d1e0b88c96db5fa8ee4110d97f0664ad63130f467c9442d43c099caf9fa3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ktab.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
        • Size 26.0MB
        • SHA256 5e0fe112f12f7b8f4c2ce5010af422a43eae8931034c43be99a81297628e3604
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        native2ascii.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
        • Size 26.0MB
        • SHA256 22a7fa74f9e52c2c873ea54ea532f77f2eb8a4ff9bb6e8191e0adb2772128a07
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        orbd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
        • Size 26.0MB
        • SHA256 9ace866f487485a9d57f4636b989d53dca1a96efb6bc2657788695494a8eabb0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
        • Size 26.0MB
        • SHA256 819f56c4995a962a103d1fea5c101b760e92c4bd4e7a82fe5f78b14c28892ca7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        policytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
        • Size 26.0MB
        • SHA256 1feb4478f389b7cedd2fc46314da30222c92eb0ddaad850977bf116b0e3b31e2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmic.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
        • Size 26.0MB
        • SHA256 0010d813bae916795722eb67f8efa4eb1717d06fc1ed9c108a61a7d355ce2683
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmid.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
        • Size 26.0MB
        • SHA256 06a440bdf42ae2739cee772a36efadc9a5e7ac04ff08a32aa2b2464eae758f1d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmiregistry.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
        • Size 26.0MB
        • SHA256 a3851d4b4349b46d026f37c75dfbe162ddcca45272bbcab78a07a4c1ddc22138
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        schemagen.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
        • Size 26.0MB
        • SHA256 122b9832ae19aa41f150ac53cecfdbf6c1da25fcbcf020eb967bac2188ba5a6b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        serialver.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
        • Size 26.0MB
        • SHA256 0a0238683bfba45bbf19629e5716fc6fc059816f10a588cc7f8f8b8b0e086ac3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        servertool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
        • Size 26.0MB
        • SHA256 92eb824f68c24bc902de5036442846cf7db65dcf4a6356e3b027f9bae563e803
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        tnameserv.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
        • Size 26.0MB
        • SHA256 41b7042c189f44c27e0dcbf280b244a4083c4a5688c88044d63ecff2f7f9a856
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        unpack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\unpack200.exe
        • Size 26.2MB
        • SHA256 f0a3130730f3cb11a3c95b868b9663a6ffd1bb2062d56b43a99389a1b6304aed
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dotnet.exe
        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 26.1MB
        • SHA256 1075c65760e399e95b55cbca86682b7c8824baf4ba4fd25e7a3f9273f257c1a4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 26.0MB
        • SHA256 bc77531c64756d9c5c5b2db910d0a3dfcb22f54dca2ff9ce7a5fb663cbe3f684
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 26.0MB
        • SHA256 28cab505f2e1413bb8ae191bbda1288815559688b73fca1e4ae4df9282c4d491
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 26.0MB
        • SHA256 7306e3a208537c2c5d70455f01343b415f32bff4dc9590514b96ad0ada4e7fd8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/1712-2-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download

        memory/3732-0-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download

        memory/3732-1-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download