Overview

overview

8

Static

static

3

2026-08-16...ar.exe

windows10-2004-x64

8

2026-08-16...ar.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    150s
  • max time network
    152s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260710-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    16/08/2026, 07:58

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-16_4bc2b56b72ee388d02011d8902b44acd_amadey_cobalt-strike_elex_emotet_icedid_njrat_remcos_vidar.exe
  • Size 9.9MB
  • Sample260816-jt7vbsttht
  • SHA256 d39d3d52af5a1ee159927b313e29e95790b5662a9f51fa0aed3641603f5ea972
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
defense_evasiondiscoverypersistenceransomware

Malware Config

Signatures

  • Drops file in Drivers directory 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Sets desktop wallpaper using registry 2 TTPs 2 IoCs
    ransomware
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies Control Panel 4 IoCs
    defense_evasion
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-16_4bc2b56b72ee388d02011d8902b44acd_amadey_cobalt-strike_elex_emotet_icedid_njrat_remcos_vidar.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-16_4bc2b56b72ee388d02011d8902b44acd_amadey_cobalt-strike_elex_emotet_icedid_njrat_remcos_vidar.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:4744
  • C:\Users\Admin\AppData\Local\Temp\2026-08-16_4bc2b56b72ee388d02011d8902b44acd_amadey_cobalt-strike_elex_emotet_icedid_njrat_remcos_vidar.exe
    C:\Users\Admin\AppData\Local\Temp/2026-08-16_4bc2b56b72ee388d02011d8902b44acd_amadey_cobalt-strike_elex_emotet_icedid_njrat_remcos_vidar.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:4216

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        7z.exe
        • Path C:\Program Files\7-Zip\7z.exe
        • Size 10.4MB
        • SHA256 147aa98c8a74463d8e77667449fb05990aaa54d306e8829cedeefe864f6252bb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        7zFM.exe
        • Path C:\Program Files\7-Zip\7zFM.exe
        • Size 10.8MB
        • SHA256 b9daad3c031af900859737394b7a71f36e4fc70c9a0f0fbf0c79cbc2daa933bf
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        7zG.exe
        • Path C:\Program Files\7-Zip\7zG.exe
        • Size 20.5MB
        • SHA256 a3af99415c116f7a8b4b2f7913743268eec493b5d8a9f82fc0a2d5203a5cadbd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Uninstall.exe
        • Path C:\Program Files\7-Zip\Uninstall.exe
        • Size 19.8MB
        • SHA256 d16a1ef800aabc604f7d6ee3b421c3b79c3753947eac9fd43a267f94b5105640
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        InspectorOfficeGadget.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
        • Size 19.8MB
        • SHA256 bef2c5b083c6388aa7d8e66b201a4f737ca73a8eccf8a2ae57af7b90fdd097d6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MavInject32.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
        • Size 20.1MB
        • SHA256 59f4d263a1f2d26990a3bf0910bb3bb7666ff63999b09bb25e7b9d0903fd796f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        OfficeC2RClient.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
        • Size 43.3MB
        • SHA256 521d0386e3a7c6c8eb7d23d973c30e19ea2e0a74915d65261f62641a0fdd1b05
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appvcleaner.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
        • Size 21.9MB
        • SHA256 e705c383eb759f5772617f3866d19182e8812dc765450e11042745afdeef8c6e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VSTOInstaller.exe
        • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
        • Size 19.9MB
        • SHA256 1156fc34a4e00c0bef4f9a5e8e110f5daefe12fda5488b9f58cc5abea6c2e556
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        setup.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
        • Size 25.9MB
        • SHA256 d5b7635d9ee026b39e4dd896ec79a1009ba599dbfb14b99c722397f9d7d14aa2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_pwa_launcher.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 21.5MB
        • SHA256 90aee235c1349195dc3e026ecc318797536f73f397f926826711486c0b615bd1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevated_tracing_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 23.3MB
        • SHA256 1c8c412dba138be954481c1c20efa5c7c75cf278b15dc03da4418083b15ba663
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 22.1MB
        • SHA256 fd45b660bd5424db65f7175083b780d40cc12fa38e7780ea84b8dc4485b0942e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 22.9MB
        • SHA256 a837b2848e7be8a72a243cf0a349b56efaa8a4b9ccb74ed3170de690c352e19b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_proxy.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 21.2MB
        • SHA256 82c50e57ac762a6e5514ea0e391ca70451c62c2d4141d328e91c754bad4004c9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 19.8MB
        • SHA256 62b9a3cbd895223522d2d3fa2a9f9f8a5096b6cbd1ae4d5e718fc2247917d273
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 19.8MB
        • SHA256 d284086355f2e0d8e00fa0d907e73e5c26eecde983dc6cc6522a5ec41ead09ec
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 19.8MB
        • SHA256 240dcc2d58198de121770ca88e85931fca155390c255b59c2c67c7949d1d7645
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 19.8MB
        • SHA256 c21b47e271b4831adb12d5d0eb9bb0437038422e8083d7f834a79fefe1304ca1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jar.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 19.8MB
        • SHA256 d255d7646ee949721335a63c5ed5d5fa91107468726e66136bbe227d1de2060e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jarsigner.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        • Size 19.8MB
        • SHA256 fda949800c060b7d15feced92264224b68cdf21b790f3b9f6171f18a01c347e7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 19.8MB
        • SHA256 4ef665e0641ce2cf417d046fd751a1699b8d4d98d8163b78b12251e9bb5b9810
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
        • Size 20.1MB
        • SHA256 eef7ced9b7a43df7bff378ef3ebdc311fdacfb1ea6b71edc764b872ead6b0e36
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javac.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
        • Size 9.9MB
        • SHA256 7647e8459efdc0965e53fd0a38a07f15929a40e4fa6e838ba5ed5941858f34c5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javadoc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
        • Size 19.8MB
        • SHA256 4bef5dde15c255bb87c93539954f410d209c3d439243c0c6ba8b9859217fd2ec
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javafxpackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
        • Size 20.0MB
        • SHA256 8fe595d9f7a00f8f68a2233f82d7b49fca0a5207f338f0519e5de3213bcb18a7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javah.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
        • Size 19.8MB
        • SHA256 dc46dc0495d7797e934eedf6880911e38809e2be84bef111e90e30c3d9846333
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
        • Size 19.8MB
        • SHA256 5dd6f81907b292379d74f78d2eecaf7180321518106eae43d920a5d66c5f5f5b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javapackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
        • Size 20.0MB
        • SHA256 43da90321d72c4eb40e5b81bc5cac5a84f387b9b0884146094f48631e818da6a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaw.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
        • Size 20.1MB
        • SHA256 22594ef7986629274e4b4abc8faf2985cfb0350ca35f7808528aff9b29b57f9c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
        • Size 20.2MB
        • SHA256 41685881d679f08c639eef93fbf5a7a73116c892fbdfca01943745c0019e498b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jcmd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
        • Size 19.8MB
        • SHA256 720bcc6a016cecefde06abd577d55d5e7bc447dcddc657fbbfd3ec35ca6c2792
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jconsole.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
        • Size 19.8MB
        • SHA256 a4b2a89cd354677fdb5bc729b3c2a390b6ca9ba73a06737113f32566af8e4e89
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdb.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
        • Size 19.8MB
        • SHA256 5ae67c13cf4db153bf254e17be8a4064ca72bf0f415370c3cf6a92399401af83
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdeps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
        • Size 19.8MB
        • SHA256 f6613c1d17b6fa1be5a146f4aae12007c4eaaf836225e6951c210036bbba726d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jhat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
        • Size 19.8MB
        • SHA256 6f12999edee6de636526fe35abbeb5d6971c2a455dbbeae9709ce0f88771b500
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jinfo.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
        • Size 19.8MB
        • SHA256 223079d0f9d633a7144b973789c35e02ecd65a1618b6879b35e44387f718a76b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jjs.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
        • Size 19.8MB
        • SHA256 1c614a181c1eeacf573ce8ee188f897c9efc656dab6f13a2b43ca051aba1e853
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jmap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
        • Size 19.8MB
        • SHA256 70184431891cb8d11f2b37c1a6104f959eadc9e335fec82a62a221445f0c2f17
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
        • Size 19.8MB
        • SHA256 a9eeb231fc2eab7465bf6f187ddb0141e7a25e95e1dd0665adf7e438daaaa38e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jrunscript.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
        • Size 19.8MB
        • SHA256 5bce12486b2fdc0db312fdcd5f9b5f53523ac94a12b33daaacf3868c6f251863
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jsadebugd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
        • Size 19.8MB
        • SHA256 2584bd7aa6969f8c44fbcccac43707da7b18024fe4be9bd5cd36eac758c9aaf7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstack.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
        • Size 19.8MB
        • SHA256 9e4c99bed2e422cbe7a6ce72adec1ededabab453525d2de27d94aadb73687bed
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
        • Size 19.8MB
        • SHA256 f728c2372b2b19789628e68ff44df5e476a0102fd900e77289721ce3054de559
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstatd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
        • Size 19.8MB
        • SHA256 4086b7185009be18d91448a3852e95ee04e3868f8bbb18fb873171572af9bb45
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        keytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
        • Size 19.8MB
        • SHA256 8c84b093aa84883a69501b886139c30b3b7c1374b338272269df986bdcdf2e74
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        kinit.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
        • Size 19.8MB
        • SHA256 77e7ed9027bc4c1fb355744a6ab8c1c3d71bb620ff9edda9281e2fa7eb7c5f8f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        klist.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
        • Size 19.8MB
        • SHA256 66c6bec5584de32742c5027e5d85be7149a0fc7299b54232eb9c24cfd0e722d0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ktab.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
        • Size 19.8MB
        • SHA256 225a6df51fb8e812250bec636a8d3f880cb939a3cf5534945d363b0f73934503
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        native2ascii.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
        • Size 19.8MB
        • SHA256 13dba3ae6242fd505188c4d8cf7122d0d118886ce291ce9fb1a3649e8611f2f8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        orbd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
        • Size 19.8MB
        • SHA256 e13ec2038978f74e7266ac06c0c69dd998a97bd8e332713727ed5aa52b7aaf83
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
        • Size 19.8MB
        • SHA256 fd0f37c3ba30268369c278248698f69eddebc43d613c5df8c24ca69a3d7f58c3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        policytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
        • Size 19.8MB
        • SHA256 6d67bce85a24766020a01cb05bc03c3da4f948119a872ab8661454ce691504c8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmic.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
        • Size 19.8MB
        • SHA256 e8e52b80778af4574ffc7c8356e0928c2a7a44d327b81576f3b7c6a346e1e79b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmid.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
        • Size 19.8MB
        • SHA256 804d19b1efd7a97948fd15894c6a089b0c57f9c784cfa3c7b44cba42de5bc482
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmiregistry.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
        • Size 19.8MB
        • SHA256 6d5d66610942f04a5302987cd82ac5dda842aa05faa16b34fa077dd4a19c41bc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        schemagen.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
        • Size 19.8MB
        • SHA256 8990cd746442aae3b03a32457c8cd319971294bcdb5b2c4a14f1ef40186722f0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dotnet.exe
        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 19.9MB
        • SHA256 6383b349b44c4c5f233b21d75fe5bddd9b49d70e2ead8b5bdf5d2c0695e3ad66
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 19.8MB
        • SHA256 2e963f0e34e6288af35a70afa3cd6d36419d2b35de431c88f04c0df0f06fc390
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 19.9MB
        • SHA256 a5d926757ceaf34b277ae4100ea763b5ece44b9d80ac7eb5ba01ace5d134eb90
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 19.9MB
        • SHA256 d649990e1d3d738622e5aafe757b706964289966f00fb59dcd49f9b5bcc75d08
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/4216-2-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download

        memory/4744-0-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download

        memory/4744-1-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download