Overview

overview

8

Static

static

3

2026-08-16...ar.exe

windows10-2004-x64

8

2026-08-16...ar.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    151s
  • max time network
    115s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    16/08/2026, 19:50

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-16_ef9283c297311db802726e4b2e4b3381_amadey_cobalt-strike_elex_emotet_glassworm_icedid_njrat_remcos_vidar.exe
  • Size 11.8MB
  • Sample260816-ykgdcafe99
  • SHA256 12d28a8a142bb233187b0a07fe553f8321028c45c25c43393a2b4e412c56571c
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
defense_evasiondiscoverypersistenceransomware

Malware Config

Signatures

  • Drops file in Drivers directory 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Sets desktop wallpaper using registry 2 TTPs 2 IoCs
    ransomware
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies Control Panel 4 IoCs
    defense_evasion
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-16_ef9283c297311db802726e4b2e4b3381_amadey_cobalt-strike_elex_emotet_glassworm_icedid_njrat_remcos_vidar.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-16_ef9283c297311db802726e4b2e4b3381_amadey_cobalt-strike_elex_emotet_glassworm_icedid_njrat_remcos_vidar.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:3880
  • C:\Users\Admin\AppData\Local\Temp\2026-08-16_ef9283c297311db802726e4b2e4b3381_amadey_cobalt-strike_elex_emotet_glassworm_icedid_njrat_remcos_vidar.exe
    C:\Users\Admin\AppData\Local\Temp/2026-08-16_ef9283c297311db802726e4b2e4b3381_amadey_cobalt-strike_elex_emotet_glassworm_icedid_njrat_remcos_vidar.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:1340

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        AppVShNotify.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
        • Size 12.1MB
        • SHA256 6050830e23087409adb98e19b903fc3c29ada8193bcc248a260d819371b1f16e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        InspectorOfficeGadget.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
        • Size 23.7MB
        • SHA256 f0a5a3d933b14b2c92f4720153dcc195ff0329dce587384546b8a3d8b6ac7622
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        IntegratedOffice.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
        • Size 27.8MB
        • SHA256 2dacab2d133f2fe0972b19573ee90cbe273b512803e0441239b6b21da57f677e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MavInject32.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
        • Size 24.0MB
        • SHA256 a20e5e123c026d84749106cb8cb4edb2bb3c8ccc5ffa0786f8a873051d466d63
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        OfficeC2RClient.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
        • Size 47.1MB
        • SHA256 0c6e864412983d0b31112397bfad27adaf4abafd97f50937a710509018115f78
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appvcleaner.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
        • Size 14.0MB
        • SHA256 df0fd742847778ea0e7978ec7b35b643fe20e3e9610c0a1a431c742e77ff1f67
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 25.9MB
        • SHA256 a32cf87dcf05595abe169ffc3a784352f5c619ebeb58e77d4a693c55b045742a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notification_helper.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 13.5MB
        • SHA256 8fda837449160dae2fd3efad56235f634f22876c101be643a40988a7604ef1c9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        os_update_handler.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 13.7MB
        • SHA256 b4d2f556845d5c31085b0433c1874490356f8dc00ec827f9389046e6a08762a2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 26.7MB
        • SHA256 a3ec5f4332ad80e77ef3a2286ae33a35aae5c41357f216623b4e697331ca04a3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_proxy.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 25.1MB
        • SHA256 5730d658ef40ea55f45661b297b52f106c5cd7807fefba5abea5802e786feb06
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 23.7MB
        • SHA256 c41d7f8187b239c7b0065f6e0355b5556c0824606b21d54c828aae068ca2bc84
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 23.7MB
        • SHA256 dcbd31630dba11f53a67987a0f407cf0794e4781c80421fd15fd07e979d8cb9f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 23.7MB
        • SHA256 c7502846e8d75b13903c8ba9e80f49ed55e9f8613457f83f816169366f2c577d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 23.7MB
        • SHA256 463b3af94d4068d7660cb719ae1a361b5d190e381b91b099663059386366a3c7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jar.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 23.7MB
        • SHA256 ebbb18b1aed3c5c69ee7a20c35e1e31fdabf6fa4733ae1648df64154584fe5cf
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jarsigner.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        • Size 23.7MB
        • SHA256 bd966bb2efa9743e14edc4a715fcf38419be4fcd7add1147adfffd9f8dce0649
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 23.7MB
        • SHA256 245df554002617b86a3864da6a332d0b7bbcc6bdcd1e2de2746bf4c3c5080bd1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
        • Size 24.0MB
        • SHA256 6534277acf0530674a529983beb587e3aeb2b92ec4cafba8bf8dafa43f49d4ee
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javac.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
        • Size 23.7MB
        • SHA256 e1af1e1ea065136df83f156e7265604bc804af8d58f162b44f4d98b96d03feef
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javadoc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
        • Size 23.7MB
        • SHA256 698d99d276bc521b6b5eba912256143be0ab1e9260f8ae805dbaa807c7332be3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javafxpackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
        • Size 23.8MB
        • SHA256 a39dc340ead684e09442cb39f29cd7a0ea3002f8d41c1860ab1d03fff2aa7d9c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javah.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
        • Size 11.9MB
        • SHA256 edad50218c69b1c71f86d67508da8d866b13f5fac6af2952ecc7f303dfc472b1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
        • Size 23.7MB
        • SHA256 c01432fc2d005c77e2e0a890d2a5f898dc9099811050d71cafb1fe97ec54c708
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javapackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
        • Size 23.8MB
        • SHA256 6f9154b91569cb147f05002e932e314fe489f70d1be0c5be42731dbbd2f724b9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaw.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
        • Size 24.0MB
        • SHA256 4c63c9e96cc43967cbd3701d6caf067d76599a46defc30d7028caf97ed19f3b8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
        • Size 24.1MB
        • SHA256 7b4a057da30cfb4c00a4c9783427b61c06b448e1663c7ae8ea8db561e204c959
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jcmd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
        • Size 23.7MB
        • SHA256 ec0ce66eedd59bd1a3ef194fce3c8320f62d0a2c6cfe673dae78ca7a56bddf4f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jconsole.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
        • Size 23.7MB
        • SHA256 925c4e89d6da1fe58ed89cfac475fde186f46b0f7c653f01c9b2cfa5c6e6342c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdb.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
        • Size 23.7MB
        • SHA256 73a3bede529413afad1936dedf9d7ee4b680cdfbdaebb6d18035de7da5dff432
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdeps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
        • Size 23.7MB
        • SHA256 1f8fd52fe2d35258e533678f87b72eb81489d56f79521acdf859ba6853ba87e7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jhat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
        • Size 23.7MB
        • SHA256 a63d5dac635a33aeb8dbf57f8b267af01c543ba42c18aa8864505eb2991c3cf9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jinfo.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
        • Size 23.7MB
        • SHA256 9438eaadc04d1782dac495102f4a6e1cb444a245e184015fe36d646dab56233f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jjs.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
        • Size 23.7MB
        • SHA256 a15d60303dc1e82e82f043f440361038b72192f1e3d2cb2a0399833c4828eea3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jmap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
        • Size 23.7MB
        • SHA256 1e729b309a16dff02e7459f84c75e92147aec08a5a2bbc186a91f28d39c3243e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
        • Size 23.7MB
        • SHA256 9fa719c064241a83c481a4ac9668e23ae8d2e8f0f8b080be0c62cbdcf57d086e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jrunscript.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
        • Size 23.7MB
        • SHA256 de4491c623fbfdc088d5b452ffc54666ecefb357ccf2c34459e1fb0e244dc54a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jsadebugd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
        • Size 23.7MB
        • SHA256 cfc769dbf38f5f72693fb571aebca3b62a8a9b281bda9994f7f4d08ee6d1fc4c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstack.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
        • Size 23.7MB
        • SHA256 d72beef0b6c15eaf8b9d8123192a3cd42b40f999de8e1f791d2a1cf11389783b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstatd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
        • Size 23.7MB
        • SHA256 787e3965d31a0666456d9f9b2f9ceca202361668ac791e4c1889c2a5c9d5c7f4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        keytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
        • Size 23.7MB
        • SHA256 1bde22ce412a2733c016f52fdfbb73f2ae0b5bd36dd05873dee2a1cfdb789345
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        kinit.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
        • Size 23.7MB
        • SHA256 f98ac9fdc7093a33376143561cf5883f7f23e4afe1c354e5c2044fb948448ae2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        klist.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
        • Size 23.7MB
        • SHA256 43b14972412a46da70b845bd12220322a9de1a33b510a4d963326adedc65f9c3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ktab.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
        • Size 23.7MB
        • SHA256 9bde3c5f266b3805c7678196e069d4954bd3ff424e01cf60518e7e98858137af
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        native2ascii.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
        • Size 23.7MB
        • SHA256 6b22be34ec0b110f0491a2153838c74cfbb02cbccca4a4e5947b48b28838d83c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
        • Size 23.7MB
        • SHA256 6b171187b85f1b567f2fd36cf4b52b63312bdf66330045db22392df65bb24b46
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        policytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
        • Size 23.7MB
        • SHA256 a02d807157d209581c61035c92da2fd7a87c3f99ffcbfffe0b966357f8b2257a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmic.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
        • Size 23.7MB
        • SHA256 1e4d1db2c4025b4d726bbbee4631a0ef4b27e9611dcc846c6820976e591b1e4c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmid.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
        • Size 23.7MB
        • SHA256 aee8cf4b7afb72adc27bfc159329a899f058fde0d6d9831973edb2f9d7cdb5f7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmiregistry.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
        • Size 23.7MB
        • SHA256 ae5b027bc5e9a7b6ca1d4bd15a2e581f8e2089316a481054679bd0a5f49a61e1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        schemagen.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
        • Size 23.7MB
        • SHA256 b12154149443417797d284f74db473f80ce3c994c72db2a04e608f8419729752
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        serialver.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
        • Size 23.7MB
        • SHA256 9dc80a0b8b3174ad36356995635213c509251fce305eec19967982ea3e184e87
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        servertool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
        • Size 23.7MB
        • SHA256 bd6da651eb3d1675ff0942e782f7b20cd284baae8733762de17200af12afd5a0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        tnameserv.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
        • Size 23.7MB
        • SHA256 f08c58516e1d656a13b8e967e5668c11fb1b015b8b2b7c66e5390a0333ad6d30
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 23.7MB
        • SHA256 c9a1695fbcd91b331014a172146823d5a6d7b5962cf8054e3609fd1c02505346
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 23.7MB
        • SHA256 6937ed133c37eac2e8a1704572137ddf8da85b34e0851968bf081f6bd4f85a09
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 23.7MB
        • SHA256 191e471bfea6d18816b013db2202522505eb010727d67e0299e8cb8ba87f523b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/1340-78-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download

        memory/3880-0-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download

        memory/3880-25-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download