Overview

overview

8

Static

static

3

2026-08-18...ar.exe

windows10-2004-x64

8

2026-08-18...ar.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    149s
  • max time network
    148s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260513-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    18/08/2026, 21:42

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-18_09f4aa097605f8c6ee5c442460a90014_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
  • Size 20.8MB
  • Sample260818-1kvl3sbf64
  • SHA256 b2a7283f48f0f8d731a88290fa7af1228511dc7760561b5757c7c1ce1edeecd1
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
discoverypersistence

Malware Config

Signatures

  • Drops file in Drivers directory 3 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-18_09f4aa097605f8c6ee5c442460a90014_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-18_09f4aa097605f8c6ee5c442460a90014_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:3188
  • C:\Users\Admin\AppData\Local\Temp\2026-08-18_09f4aa097605f8c6ee5c442460a90014_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
    C:\Users\Admin\AppData\Local\Temp/2026-08-18_09f4aa097605f8c6ee5c442460a90014_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:2132

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        7zG.exe
        • Path C:\Program Files\7-Zip\7zG.exe
        • Size 21.5MB
        • SHA256 690db3fc1a49a871c42a71e77d536965a6159b79fdc090420e933eff68f102ac
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Uninstall.exe
        • Path C:\Program Files\7-Zip\Uninstall.exe
        • Size 41.6MB
        • SHA256 c61c2aa889144b46b8d7b3519f0c40a6d395a5af18047ecd8713a953877252e3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VSTOInstaller.exe
        • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
        • Size 41.7MB
        • SHA256 c9c9b273d1f6eeb98d7f5f6e28c2205862091f3f0b3306642bf86008c96de91f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrmstp.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        • Size 47.6MB
        • SHA256 dcf220682682ae091b73221e899ed71c8042375eba8217db9cbd039eac262de6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_pwa_launcher.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 43.3MB
        • SHA256 521ff5d173395fa362be4f70a8e7cc116adb4181c8a8840d14f538cbed211f31
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevated_tracing_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 45.0MB
        • SHA256 b88a8727a5e80a281c6f05f681b63e45582ef3adee3b95eb634cdcfec3163abf
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 43.8MB
        • SHA256 2697d67966041f6dcf815701474563c25d6d511866e77b728dfe9dae15dd9a24
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notification_helper.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 43.2MB
        • SHA256 569b4a97c3539f3ae32c7ab9d5f31401883a72523950b33984b7d87513dcd14c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        os_update_handler.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 43.4MB
        • SHA256 1bec5d4049bc50993245ec409e8be824e8dd80e02a44907a81edc7bb17b210ae
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 41.6MB
        • SHA256 226ab635720d0dc73f854b0eabf07ce25909b075c50a49fbe0512b13c22fbfe2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 41.6MB
        • SHA256 d3369c5f84b33054d361aff540660e196ba177db8499ee71f19a4c2dfccf6b4c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jar.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 41.6MB
        • SHA256 1af22dd551138edb1695e7b95f32a51d320ff12d04550a15278ded7ccd392865
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jarsigner.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        • Size 41.6MB
        • SHA256 67d1b8a89f4ceb7169c40fe71c24d11287208e14133b7154307b79a260d831de
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
        • Size 41.8MB
        • SHA256 4983d67f1fe0bccf8f60e6299948f1d2bf4a173c440d0202f4322004229948ec
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javadoc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
        • Size 41.6MB
        • SHA256 243e53712f76c1d64de4152d9dfff54adfbf138dbc309f98355c1d0ecde5e3f4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javafxpackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
        • Size 41.7MB
        • SHA256 81cc4792f6b6ff131becd780be79d03060ae98cb25ce7d43e85e38d6da79f878
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javah.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
        • Size 41.6MB
        • SHA256 df2e3422373c41b8180df731ed218e53b3a007567762b693c79654347813cc0b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javapackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
        • Size 41.7MB
        • SHA256 3f9c0da7ddabf709124292c34830b3f6ed25b8d2e2066e18afb28862b117088c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaw.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
        • Size 41.8MB
        • SHA256 ecbb6980fa795af4b5175a6c68d1fb0f5738a905e165d43d468b1e4023be93bb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
        • Size 42.0MB
        • SHA256 4bdedf0f49812ca4271317f5bd182c6276ff3711a387eb9b2ecbe06fee6a216b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jcmd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
        • Size 41.6MB
        • SHA256 55aa84b72a9eda37571c478512fe59754a0b6d86bfbcc2a398f08c3c7b406f92
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jconsole.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
        • Size 41.6MB
        • SHA256 fabf748bc00d96232c02c06f007f05b8e59c25b2107aded4e4c6806149750dd3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdb.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
        • Size 41.6MB
        • SHA256 3ce94bd1d1842c4e2ac1eac838b978f9331b3b6ad5704273938f660c4090b214
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdeps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
        • Size 41.6MB
        • SHA256 14ca87950450a294b7dfa803cfb838f84df8b4595f2bcefdd54431c631509a59
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jinfo.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
        • Size 41.6MB
        • SHA256 f6fc997bd7beee60bafb94e148472784b9b240cb24e7cd7d9f472977c8195fa2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jjs.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
        • Size 41.6MB
        • SHA256 c2ed9c2dcf3a60c12da29d6bac01ba874aaac7322a4d52fcb73f3f49453d5454
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jmap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
        • Size 20.8MB
        • SHA256 39ba564f90eefc5ef1da0995181a63bf3ca689b47b16b1c11a5ea16bce0b10b1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
        • Size 41.6MB
        • SHA256 f838dd87bdc018348589386d8f4565dbe1a50cbcbeb60821d160fe206885b4b6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jrunscript.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
        • Size 20.8MB
        • SHA256 34b2cb33ad4844ebf81e26f76e697aa568fc354d7bb9d584385c55f9ff234fd2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jsadebugd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
        • Size 41.6MB
        • SHA256 6845207e278b1426b8d0981f7577b7872a95faf564ff0165fb6d926816bad992
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstack.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
        • Size 41.6MB
        • SHA256 733e160cab7bcbf565077afea243f77737bd573e139326c6c7e8f1f0ffa24376
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
        • Size 41.6MB
        • SHA256 2964ad3460fb154f794cf20eb3db092706a7c482dce9717880af345e232c472d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstatd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
        • Size 41.6MB
        • SHA256 9ccc00b0c3eed35cc102b86e34c6e66637477383d3798b34e96694ec33aaad2a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        keytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
        • Size 41.6MB
        • SHA256 d5df8b40e0d5e93cf586f5612d9fe40800185cfa27582f4be566eb1cbf8f9783
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        kinit.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
        • Size 41.6MB
        • SHA256 197edd13aec3fc4efbb52de6990983470e87e7c1e49694b049eefd05ff8f1df7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        klist.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
        • Size 41.6MB
        • SHA256 decc358ca6fbc778bda0fdab97fcf4c65b339e04065b56e1d5731f34a9dd4d8a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ktab.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
        • Size 41.6MB
        • SHA256 88acd0068fceb54b6e3d5cc337a531f6b93a002c69b09964bed72d17b4f3a405
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        native2ascii.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
        • Size 41.6MB
        • SHA256 b687e0da2f33d05aa5205d51f82d5b19b65622c7624a8478591845023f39daa5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        orbd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
        • Size 41.6MB
        • SHA256 978e5147b875535860c5531c0b2e188ebd4a522931c8b8dccdc0bdf13679f0a8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
        • Size 32.1MB
        • SHA256 661bd3f905774870c9dcd4c4a3cbec25bec29e782c21077535e1b8b87ed84e5d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        policytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
        • Size 31.2MB
        • SHA256 d705748fb69fed5671d7eeb1b079a1bfca688a0d7c9fe536d11797a5cf9267e3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmic.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
        • Size 14.9MB
        • SHA256 87ecfbd30f54b500ab9c76e3095a507e4e6dc6ffacfb337bc5bb5d8ff9ccb929
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmid.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
        • Size 2.7MB
        • SHA256 dabfd0d32fcc17e3120aa20320f7fb9e36cd987e5e5660e373ed3b8ef350765c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmiregistry.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
        • Size 2.4MB
        • SHA256 6ba199070dee43fde76524ab5ed1f37fff8a4ac1f06c3c8bb569083a1797527f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dotnet.exe
        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 41.7MB
        • SHA256 95fdcdaf76455a03503ac93ec1933eb2c8d49055f1bc29269eaca846f36ab4ca
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 41.6MB
        • SHA256 2a185cf23e11386e1a85d0100fe30e4e4af2ca6535fb8c48306be127757533a2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 41.6MB
        • SHA256 e6c44ee972c18d0d1f9e55309765929c322fe623d0d5419d8db1c4f3d8c8408e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 41.6MB
        • SHA256 ee4752da24ecdb687960214f37fc7be396c90db5f29f7fbd46f3b72f3c487b30
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        spo0lve.exe
        • Path C:\windows\SysWOW64\drivers\spo0lve.exe
        • Size 20.8MB
        • SHA256 b2a7283f48f0f8d731a88290fa7af1228511dc7760561b5757c7c1ce1edeecd1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download