Overview

overview

8

Static

static

3

2026-08-17...ar.exe

windows10-2004-x64

8

2026-08-17...ar.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    149s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    17/08/2026, 15:23

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-17_9ed72ebc52eca162f5eed69424892e37_amadey_cobalt-strike_elex_emotet_icedid_remcos_vidar.exe
  • Size 7.5MB
  • Sample260817-ssvm2stbnb
  • SHA256 2c8fd10602645d472e534105eb8ff11f9389273dc57f62ff528af47fb0894a6b
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
defense_evasiondiscoverypersistenceransomware

Malware Config

Signatures

  • Drops file in Drivers directory 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Sets desktop wallpaper using registry 2 TTPs 2 IoCs
    ransomware
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies Control Panel 4 IoCs
    defense_evasion
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-17_9ed72ebc52eca162f5eed69424892e37_amadey_cobalt-strike_elex_emotet_icedid_remcos_vidar.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-17_9ed72ebc52eca162f5eed69424892e37_amadey_cobalt-strike_elex_emotet_icedid_remcos_vidar.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:4304
  • C:\Users\Admin\AppData\Local\Temp\2026-08-17_9ed72ebc52eca162f5eed69424892e37_amadey_cobalt-strike_elex_emotet_icedid_remcos_vidar.exe
    C:\Users\Admin\AppData\Local\Temp/2026-08-17_9ed72ebc52eca162f5eed69424892e37_amadey_cobalt-strike_elex_emotet_icedid_remcos_vidar.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:3308

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        Uninstall.exe
        • Path C:\Program Files\7-Zip\Uninstall.exe
        • Size 7.5MB
        • SHA256 5bfe6dca510be05e86fa579807bdf26df47ebb8638ff6eaefb70a8676c070a17
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        AppVShNotify.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
        • Size 15.3MB
        • SHA256 b9d30145d18484772cf27a52528ad69bb9711be5ec64f551fb99a6f1c34b2420
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        InspectorOfficeGadget.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
        • Size 15.1MB
        • SHA256 b99518bb7970a1d8c4fe4d68eb61d8832238d59ee21ea914831b4b4c2ae248e1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MavInject32.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
        • Size 15.4MB
        • SHA256 050cfadbfd2d6573afeffc4757571e65dfc69952c7a9716f57cd23602181fdce
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        OfficeC2RClient.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
        • Size 38.5MB
        • SHA256 9024b4423c48ab7b642b0ecccb57bf9ff5e5d11afe8aed8c6715fac4fba7019a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appvcleaner.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
        • Size 9.7MB
        • SHA256 a5375bbb60e328e29972267ff49861d925af860fb8a4e602961a82152dd775f3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VSTOInstaller.exe
        • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
        • Size 7.6MB
        • SHA256 c52f443d24d816d40d2596edcd73d75011adb14c5d826837d997a4877a199ade
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrmstp.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        • Size 21.1MB
        • SHA256 93192f4f4bf11a2367da01c06047f0c791e18e88aaf1574c69b81fc46046d268
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_pwa_launcher.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 16.8MB
        • SHA256 ecad9fbca2817fa3025203a5ee04d721885083c186c574feda7f9e80e7b365c5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevated_tracing_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 18.5MB
        • SHA256 52476e5f66ec3eb94d25b0186e061fda9f82aea9b245bc87523b12263e69a605
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 17.3MB
        • SHA256 0cb8cbc7f7de63605119680584e932f6a2cfc41a2ab9d86187f8d18ef41a7ecb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notification_helper.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 16.7MB
        • SHA256 3d1beb09a8ae7d246ac327f22f7fef7b903d2a445048129c179813ed61ed5f1d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        os_update_handler.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 16.9MB
        • SHA256 eb2238c9d98bae0d14490c0afb1c623395834439fb50b8f38c1199a5adef079e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 18.1MB
        • SHA256 dff62f2427f54f4e2c586c52d1479762703b90c516839a89f42d68cf19ef759c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_proxy.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 16.5MB
        • SHA256 339a5bdc27553683eedb864955100f82187a272a2c4d46a356ab0a6bc209d468
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 15.1MB
        • SHA256 7b98fce0d2531242a3c2532556ec0f1fe3d4e2e1de3d0676fbf0ab11d8ff15cb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 15.1MB
        • SHA256 171ffd7f0fa19d943933325fe3f915871a65079ba58edb28c009c88adeb9e7a9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 15.1MB
        • SHA256 d7e85498c4b96d64c98f1adee65a375f5fd22acb51cbc20a7c902072c5a82201
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 15.1MB
        • SHA256 d568e8d66d29de5bb6df638f301c6ad162ddafede9d16744479caffd6bb4f4d8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jar.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 15.1MB
        • SHA256 81331c345b12e35b75c2f6d62403cc071bd3dee39e43140f5dbde44065717a00
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jarsigner.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        • Size 15.1MB
        • SHA256 398e8770ea3a901487efa61a6398bcf3aeabbdd2e6a07c626e153b036ca442bd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 15.1MB
        • SHA256 46d903863e30b2b6cb3064af7398c87a606a0411985f96846be6c64506c7c82d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
        • Size 15.3MB
        • SHA256 cbf9f6de2a8acd9b192c743b3decb3c72c575e9e0c2aa20de44c1fe50f2c8df5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javac.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
        • Size 15.1MB
        • SHA256 44fa236e8e8b935f6d1fd6a8c6786058ace2807e33ea018badda7938d3b4fcb1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javadoc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
        • Size 15.1MB
        • SHA256 b0a3d8d7eeed798aa8604f0edf4df020a37cfd66db04b43e94b2d7b9f3187b3f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javafxpackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
        • Size 15.2MB
        • SHA256 533d88513c5e2e75f6f458f9e5fdab2d81bb1797923fef24ddd69783db06681a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javah.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
        • Size 15.1MB
        • SHA256 7bf855b518d90622994facacf52594bb74c475ba6593713d5148eeeea38a9db8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
        • Size 15.1MB
        • SHA256 68307affa26011a8b31e9e72606d32b85e2ab7985a35aa015b0b2b006824c20c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javapackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
        • Size 15.2MB
        • SHA256 37637b6b4639722958c89b4ab8d1226cf86454b6a194fcba1dc69667ba3d5a33
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaw.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
        • Size 15.3MB
        • SHA256 bb1b60399d897b51a7998bf1ae2bd41117ca1660e14547c926891f3f691fc9fe
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
        • Size 15.5MB
        • SHA256 95b1b93baee8cb63bf1a84862ae76233eac835a082fc12b804e2cb3494cdfcf6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jcmd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
        • Size 15.1MB
        • SHA256 0e396796e0bf2c702ac99dc59a98e659fe0d09e6da538cafb5ba3ba9831a54e3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jconsole.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
        • Size 15.1MB
        • SHA256 26fe740556275f7ec8f495727dcdc9401746d5972d81ad1022cb703a3cfc24bf
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdb.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
        • Size 15.1MB
        • SHA256 ab6469119362466c85feee025c14ff9847cab0f98172b1c1a7f62eff481d9afc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdeps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
        • Size 15.1MB
        • SHA256 25e0a0eded9baae24b7ed7e1b5ff9dd69a14a97833597389fdcb62f88240ccc1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jhat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
        • Size 15.1MB
        • SHA256 c26026109e3da66a06635a46c90ab5382b9a380abaf47e8dd163cc48c8390ca7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jinfo.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
        • Size 15.1MB
        • SHA256 ce802b2fdfeefb74601845d599c86df82b4e771027e4285fe087f75804c6856d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jjs.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
        • Size 15.1MB
        • SHA256 315f72a2fc09b83096efa97700d293a85ead5d1a0cb1531cf052b859db353a3d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jmap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
        • Size 15.1MB
        • SHA256 7446c0af8597fcc1bc5a80bc6994e1822a9f30167e67b2f144f26aacb8227016
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
        • Size 15.1MB
        • SHA256 8a82b612d192201860fb0e1a024edd6c146048e7b871caf4ff6eff6f550c79cd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jrunscript.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
        • Size 15.1MB
        • SHA256 1ca8323741202657d31b4864832ff7642169498462f12b594e561d74ca48934e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jsadebugd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
        • Size 15.1MB
        • SHA256 160ffb2feeca79649f53d1a62c268e2923e29b827225e962422f67450cd31fdb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstack.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
        • Size 15.1MB
        • SHA256 d1d12c8950181469e807c429dd3ce318514d82c2ac1d79ee398f79724271ab2f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
        • Size 15.1MB
        • SHA256 69772df9c06efc2e39ef1555cc85273eeef451e68567de9de6733ac158b33e7f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstatd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
        • Size 15.1MB
        • SHA256 7116e9bbbed3d4739262d59ff1bb5f315f564f476d9afe941fd45ef9d9c13aa5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        keytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
        • Size 15.1MB
        • SHA256 62685fd345a44642e4cb5ee3bf3c78845568df4120926e9dcb9de788fe9bd670
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        kinit.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
        • Size 15.1MB
        • SHA256 7b6172169d5ccfb190cf7a6c30e8e4c38cb4ce4250388099c3550d23666cd399
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        klist.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
        • Size 15.1MB
        • SHA256 523955c9475a9b34667e078130b2786dc649e103c8fc54c63be25d190cece354
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ktab.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
        • Size 15.1MB
        • SHA256 0952373526ba813daea48539c455646856306132336a822341cb720c398321d9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        native2ascii.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
        • Size 15.1MB
        • SHA256 cb0875fe3ae2417a8742a9452a49c1cf058f7606b097fbc41fd9ad33d3d5649c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        orbd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
        • Size 15.1MB
        • SHA256 6b041115594bf9d2eeeffc282595b3c9f56988cac6db5a255f7a2541a4e318a1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
        • Size 15.1MB
        • SHA256 7899d1affc510b976fd809b09bde6a0f0ec358f6715e9b38d77bb1cde016ed8a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        policytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
        • Size 15.1MB
        • SHA256 79bbbede875034b71577c464ebe07c5d7d0cf4039f97a27cb06ea6663039de6a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmic.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
        • Size 15.1MB
        • SHA256 0432fe077c4764ff9467b3153708e3b3ff76225759d2c70d461f81508dfc7258
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmid.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
        • Size 15.1MB
        • SHA256 8db68e5446d50b3ed34a0523b32f9841a5351ee69ed0ca5a8b65341108fa8ce5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmiregistry.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
        • Size 15.1MB
        • SHA256 556b60471e9a7d1f8118291228ab06ba47723c29e2addc95e2d77556753ff301
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        schemagen.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
        • Size 15.1MB
        • SHA256 48b347d2673b357607af7eb9e956b46607480cbc0cfa4dba99526611726c2952
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        serialver.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
        • Size 15.1MB
        • SHA256 ddf2bd08d4ab0c9caed16e1352ee9e3504d26f0bef3b7aa59c94d5183ec2050e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dotnet.exe
        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 15.2MB
        • SHA256 365567e3033d2eab00a12d801cb837c0c0f8bf14af204985ce421a87304cdf7d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 15.1MB
        • SHA256 762767b3b68c431206d17b31423fbbb43fcc358f966aa81af0b72f70d8fbfbb0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 15.1MB
        • SHA256 174103a7d72e7b5787e23b4d7095413708056ec746782c453cdba4259bcff9c2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 15.1MB
        • SHA256 7d6075cc5617c659e4ac56d823602a777506ea9eb99bacd06cd3829b1a7c414c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download