Overview

overview

8

Static

static

3

2026-08-16...ar.exe

windows10-2004-x64

8

2026-08-16...ar.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    150s
  • max time network
    148s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    16/08/2026, 04:02

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-16_9bed4ff3b8d5e8d37130a913221bb9ce_amadey_cobalt-strike_elex_emotet_icedid_njrat_remcos_stealc_vidar.exe
  • Size 14.4MB
  • Sample260816-el8dnsbb36
  • SHA256 e425fd7231f2d14a1308515f3784ebb08f93a9d48c40544a1bbcb7c8f67fdc62
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
defense_evasiondiscoverypersistenceransomware

Malware Config

Signatures

  • Drops file in Drivers directory 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Sets desktop wallpaper using registry 2 TTPs 2 IoCs
    ransomware
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies Control Panel 4 IoCs
    defense_evasion
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-16_9bed4ff3b8d5e8d37130a913221bb9ce_amadey_cobalt-strike_elex_emotet_icedid_njrat_remcos_stealc_vidar.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-16_9bed4ff3b8d5e8d37130a913221bb9ce_amadey_cobalt-strike_elex_emotet_icedid_njrat_remcos_stealc_vidar.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:3340
  • C:\Users\Admin\AppData\Local\Temp\2026-08-16_9bed4ff3b8d5e8d37130a913221bb9ce_amadey_cobalt-strike_elex_emotet_icedid_njrat_remcos_stealc_vidar.exe
    C:\Users\Admin\AppData\Local\Temp/2026-08-16_9bed4ff3b8d5e8d37130a913221bb9ce_amadey_cobalt-strike_elex_emotet_icedid_njrat_remcos_stealc_vidar.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:4840

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        7z.exe
        • Path C:\Program Files\7-Zip\7z.exe
        • Size 14.9MB
        • SHA256 79a646ae26e71768ff4a0a0e2453f40263d7438a02d6723860b0c6091dc2b169
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        7zFM.exe
        • Path C:\Program Files\7-Zip\7zFM.exe
        • Size 29.7MB
        • SHA256 d0b5109910c6281c2380ab691d26a7740bf2f7212212cd0fd26295bdc6009230
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        7zG.exe
        • Path C:\Program Files\7-Zip\7zG.exe
        • Size 15.1MB
        • SHA256 e875c0ed01c3e884e883eb580b8faef41857a6af3b485d42e4b7341bd7144b58
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Uninstall.exe
        • Path C:\Program Files\7-Zip\Uninstall.exe
        • Size 28.8MB
        • SHA256 2d2d0a65751d7f6f4e31822f642c54ab38077a01fc6e2798b87ac974d89c346c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        AppVShNotify.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
        • Size 29.0MB
        • SHA256 c0183fa785c570a92c207703eef5af8a67c40e9b8c0586c7c6c1a68d20f3cf23
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MavInject32.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
        • Size 14.7MB
        • SHA256 b6792f4d9ef5bc9666e91aa292bd260c12e46109a6ecf44d5cae50527ec43a3b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        OfficeC2RClient.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
        • Size 37.8MB
        • SHA256 61021b932db7e6913150ff5d7b329150456c393ca920b001269ca3e536bc74bf
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appvcleaner.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
        • Size 30.9MB
        • SHA256 d4a159de6f2e8e89875b2e74609b52c296f9ff874951cc07ba82a4618d5fad58
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrmstp.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        • Size 34.8MB
        • SHA256 4423bd52f0257a5c8c28365b69c77bcc98535af7916c98238661a4edb77d40b3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_pwa_launcher.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 16.1MB
        • SHA256 389157b056b55c28643731eb8a8bee60c05a9f77f4a0e3160b1d1c06bb7f541e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevated_tracing_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 32.2MB
        • SHA256 d02c10469e5614b46e239e028f7f5332f922ee48fb00810a9e9ad1d2c13516e5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 31.0MB
        • SHA256 c5e9b11b0a3c5d2364ad3554f8155d1565d041fa95c9a4cb5eaa3d09037074e2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notification_helper.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 30.4MB
        • SHA256 b9b6f952cc2cd9f2665de0b21689b747a31aa14fdeb3127263192dc2ec7c9b9a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        os_update_handler.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 30.6MB
        • SHA256 e406f4ba8e8bd3a3525cff0243f4c687b9b6eabb76dd2b04a26b88c2a3655c62
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 31.8MB
        • SHA256 dc713830516c84ab8b283baaf615ff8f5531ee36a760078b7091b3421cc57c91
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_proxy.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 30.2MB
        • SHA256 34a18d9dbdc281d244968bfecc2e247125f9316d602310eac6e61999fa58e7b0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 28.8MB
        • SHA256 f9ea9c819d8663ca1e947e9e8ccdb6f799506c9025524a571076c82618ae2a00
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 28.8MB
        • SHA256 de9b20cd8ccb9d45c0dde299214489cd2869f7423aa49215ecd79e407d707fcb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 192KB
        • SHA256 cc71df767f30aa32b4d730d3c0244896e3d45eb216f18568c46371d93640cac9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 64KB
        • SHA256 d2eb08ebe0c7e7ff2223b6feb8c95f679251883e0b850d913bfa4b604432b861
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jar.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 512KB
        • SHA256 54a9cdeaa70d56716fea0c2b033f8174b1495f38e428abc781f5cd97cc816efb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jarsigner.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        • Size 2.9MB
        • SHA256 b73d85d013a859c59ba8c16f07a52cc9945e871d9a3e7bb85e6c4439f009e293
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 256KB
        • SHA256 a88ab2eab13680012502e10692ec5c6fb70e333b6df630e671ad53aaa93b2f63
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
        • Size 29.0MB
        • SHA256 7cdb14901b4dbcd90be8b8934948fd24e068e004e802b248d082b46693627deb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javac.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
        • Size 28.8MB
        • SHA256 0b5b2d3f558b8e246e626dd5cdc427ea7b6a850a638e4fddcedbe2101103d447
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javadoc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
        • Size 28.8MB
        • SHA256 c8a45c520edad7d9965045ce83ee02af63b0cff5b01519fd5e0acb9088579fd1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javafxpackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
        • Size 28.9MB
        • SHA256 5270acbc9b9c712c893a544246abecbe4158144dac66ff7c626f9e06c688a08e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javah.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
        • Size 28.8MB
        • SHA256 f4cdc87c74b69a198ef166b12d5f3e79ef785b8904011f5cd22511806beaa63f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
        • Size 28.8MB
        • SHA256 eb24256f8fb2dba6c9c4fe35751251d563ba8aab352f39b6a172c0ae95a4e0cb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javapackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
        • Size 28.9MB
        • SHA256 dd528b714cae8d5dd577db1b80be084936b20b34270cd7c848f1a9a6b7a83a61
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
        • Size 29.2MB
        • SHA256 c33686d8d5a205d3c1d6e44ec936f0888feea06f8280dd608f2254250a71767a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jcmd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
        • Size 28.8MB
        • SHA256 0734fa0552531c4e43c8e15a03c91d251a370f7c859593b69489fd105a51518d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jconsole.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
        • Size 28.8MB
        • SHA256 3b9d065daa6716268950aa5776e026a55eb93116944b026e01e328a594c6d4c1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdeps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
        • Size 28.8MB
        • SHA256 13eb6cd08725b23fa70d6b334e34da30673762aaa069c42cf34b0c0b03e8ce87
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jhat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
        • Size 28.8MB
        • SHA256 3e8f897177f7b101014df7c99301aab4f441b4d75d6945fde9de17f0f2006416
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jinfo.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
        • Size 28.8MB
        • SHA256 f1e4933c21343fdad13ff47c3e500c6a86871343059e96d8652536c60844005e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jjs.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
        • Size 28.8MB
        • SHA256 e271b7a7faf4cb137ad907d6b698a65791954028707659628c5e988b6d439152
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jmap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
        • Size 28.8MB
        • SHA256 f93abaa2054341487c6ba0d5331192090a9022d6859a15a01efc21f9574c6259
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
        • Size 28.8MB
        • SHA256 d9dc2acd30010ba702cf793cee28498c39f20eab9011673b7195e38402b6b3e8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jrunscript.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
        • Size 28.8MB
        • SHA256 e108f993867996b74c7742879fd886c128830c4b98284443e293e6c8e02d53d8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jsadebugd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
        • Size 28.8MB
        • SHA256 a3c18513e2007a098ed61ab4172da7bb50ef915b46b0db6dbc9a9211ef96b475
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstack.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
        • Size 28.8MB
        • SHA256 a066c152306116203584c56b45ef2ad190335cc42a6ae0e5b6237c63d7c02aa0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
        • Size 28.8MB
        • SHA256 7efb64fed3ff729a24be25bf52e64fa65f0c5157e1a518025eb979faf579559f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstatd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
        • Size 28.8MB
        • SHA256 b3a82c09dbd5db66ca5f8d6e212575b2cc7538ed0ab1e2253af23742500bffed
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        kinit.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
        • Size 28.8MB
        • SHA256 72e197ad6f2d746ea59868aa8a216ed773c39709a987e61b6b06786cdaeb4398
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        klist.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
        • Size 28.8MB
        • SHA256 8fb6072a50010c31cf4ce79b5ad9a39649aec8515f12aeaeca9532eb15a382f8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ktab.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
        • Size 28.8MB
        • SHA256 768d2d6e2e9a492e6be011c04ed1bf9c4beefc9b9f157400d88b19c8012f3eea
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        native2ascii.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
        • Size 28.8MB
        • SHA256 194da8000a9bdbb483acda641fef98012840e29b272b351fe10ef82d2120cf3b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        policytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
        • Size 28.8MB
        • SHA256 4e4e55f122e439bb64228e5d02959d4f4914fc10d8ee782c48280ad20b2aafff
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmiregistry.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
        • Size 28.8MB
        • SHA256 d7333622327d4c5fd746bd3073ce54d0a65de149c28237c848866533de76f498
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        schemagen.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
        • Size 28.8MB
        • SHA256 62231290f4f8474b6e0ab9e12132fce3e689fbfc3d67da0c98ed134fc00569c7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        serialver.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
        • Size 28.8MB
        • SHA256 bf838991a614f5d1a672daae0c0e43444faf3b4b524b1df16b4a79894c948556
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dotnet.exe
        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 28.9MB
        • SHA256 0968ff7160f86415ce78cfee9d4e003d451be45666697615f4fc1c65b41c0359
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 28.8MB
        • SHA256 e2ee688c56987e05b9a9ae9ef21408e91a0cb5c97b4546616149a7dca2b8909e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/3340-0-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download

        memory/3340-1-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download

        memory/4840-21-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download