Overview

overview

8

Static

static

3

2026-08-18...ar.exe

windows10-2004-x64

8

2026-08-18...ar.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    120s
  • max time network
    136s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260513-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    18/08/2026, 15:00

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-18_66c67610720a08db3de2f10d4fd439d4_amadey_cobalt-strike_elex_emotet_glassworm_icedid_remcos_vidar.exe
  • Size 15.3MB
  • Sample260818-sdctpavaqe
  • SHA256 b9d30145d18484772cf27a52528ad69bb9711be5ec64f551fb99a6f1c34b2420
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
discoverypersistence

Malware Config

Signatures

  • Drops file in Drivers directory 3 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-18_66c67610720a08db3de2f10d4fd439d4_amadey_cobalt-strike_elex_emotet_glassworm_icedid_remcos_vidar.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-18_66c67610720a08db3de2f10d4fd439d4_amadey_cobalt-strike_elex_emotet_glassworm_icedid_remcos_vidar.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:628
  • C:\Users\Admin\AppData\Local\Temp\2026-08-18_66c67610720a08db3de2f10d4fd439d4_amadey_cobalt-strike_elex_emotet_glassworm_icedid_remcos_vidar.exe
    C:\Users\Admin\AppData\Local\Temp/2026-08-18_66c67610720a08db3de2f10d4fd439d4_amadey_cobalt-strike_elex_emotet_glassworm_icedid_remcos_vidar.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:5032

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        7z.exe
        • Path C:\Program Files\7-Zip\7z.exe
        • Size 15.9MB
        • SHA256 512a77d9c536a320d1fcc8b5f166e009b648a5e509c3c7adc6c95f5384f64f63
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        7zFM.exe
        • Path C:\Program Files\7-Zip\7zFM.exe
        • Size 16.3MB
        • SHA256 511a1286684443afe6856ae4d16956effaae6e93eb784f465aeaf4f28b0246e2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        AppVShNotify.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
        • Size 31.0MB
        • SHA256 ca7aed9eef38320dffce9640caf39cd536c328ca3883b68d113fd9a1cd2058f2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        InspectorOfficeGadget.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
        • Size 30.7MB
        • SHA256 2b8ece9a7fe0a16ef27b59d4bd17736d0e7ac0c4074074e31660d7f0d44d2b36
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        IntegratedOffice.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
        • Size 34.8MB
        • SHA256 476cac410ceb2d2f30c7400f0d7eaad5383397391a078dc6af8ea0bdab16184e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MavInject32.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
        • Size 31.0MB
        • SHA256 aa0cdd43a7e39a586cb6de2340f5f3343420ee6a709c24a12937729235420640
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        OfficeC2RClient.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
        • Size 54.1MB
        • SHA256 2585018eb72b03a12338281590271ce8133a090d6573e864fe1fb89bec295bc8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appvcleaner.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
        • Size 32.8MB
        • SHA256 aefad1975434505cdf0653a7f7cc1180f0958e68bf9ce9cd0830655b60af1ba8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VSTOInstaller.exe
        • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
        • Size 30.8MB
        • SHA256 6c9d02454ea8f14df397b93b5401f29df4595f4a238fc76f02c25991d22a6fa0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrmstp.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        • Size 36.7MB
        • SHA256 7bdd91e93ece2721c6013071f08fc78518beb72e60954f3bbfd17eb2657309ab
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_pwa_launcher.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 32.4MB
        • SHA256 bdba4d033c839304574ad5c30e6b5434cc5fa06ef41d5147fa54f4a7904da5ef
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevated_tracing_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 34.1MB
        • SHA256 bad941593c9951b6dd3ae296c55feaececbe9ebbe1bd1428bb065d77496047d4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 32.9MB
        • SHA256 5e87fce17f890c5e623cc25ca8d68d25fce6e621e30ff248fd58e14b9bf9bb4f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notification_helper.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 32.3MB
        • SHA256 b1cc59b7531827b786e5b6f770ae71cd4b25ea7ebee5e249ad86a333ec1d4e3d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        os_update_handler.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 32.5MB
        • SHA256 6ecf3b2332aa90b9a193dd9ba4f69ab5ed63c122d803dbdf894310fa2e962ced
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 33.7MB
        • SHA256 6161280d3a21ad880baaf6d6477ecea0671a0ece1edef91679ffb192629019d5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_proxy.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 32.1MB
        • SHA256 eaf07519102d4b187aa127a41f3bc5d75548f7761526d530d958ff0d6851f9ad
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 15.4MB
        • SHA256 8a3e45ae2edbd4e5982894d463ea2bcfeca0535eb051ed151c15db52c7f5d2f9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 30.7MB
        • SHA256 2429238184648e83609f47320b3342e2f2acf7b398db4c7ca42662cbf10a7f24
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 30.7MB
        • SHA256 2e83479242d2f68c3a0d8943397ce642e0c9f78dbbcf9c2733735a28156a6cc0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 30.7MB
        • SHA256 499a9c396b944aa1e663e2faa2a5e8de775deeb7cd8e51b45ec7313f27424a7e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jar.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 30.7MB
        • SHA256 2f77487d53caef5a441a36a694908922ed70e04be1517cdcd72d1a7685f51c6b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 30.7MB
        • SHA256 f9d9bcaa7cf6f1ca9a2ffee4407918d390e67738fdba03e5182cd2979d4d55e8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
        • Size 31.0MB
        • SHA256 c3d295c54f47a2e34cc39fb678adb30b8e5ab3149472b0d2e074988ac0598ae2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javac.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
        • Size 30.7MB
        • SHA256 9fc5e8f5d566e058f2bde0b634a5444d7770a84826f8697e83c13cfbbbc39d8e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javadoc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
        • Size 30.7MB
        • SHA256 96ca66ac390930fa6c68b1558602dac05a12d851337732768bbd53b53fbe9fd5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javafxpackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
        • Size 30.8MB
        • SHA256 c6bb2dba28dbbb82c308bf7a115fe69b2cdc96ec73143053dfec56fe8b3e57da
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javah.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
        • Size 30.7MB
        • SHA256 9b6be2277251ef0b0460eb6c69ebbcda348564fef530f9f1686bfdcd977618b0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
        • Size 30.7MB
        • SHA256 360759c490cb1bbb9725e9231e68560efb90f9086b609d1dfbfae691a5cce07d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javapackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
        • Size 30.8MB
        • SHA256 8d1ba6f5a071ea23d95b3edf90f78f80ea7242d209aaa0341383fc93adb11f87
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaw.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
        • Size 31.0MB
        • SHA256 4d5d400e9c9039b87d8ef99886f30336a93544e6269124308ede9cefca4efda8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
        • Size 31.1MB
        • SHA256 2ed2fb19150eb6ecd2006c3e40fe114fd7de4ebd61e78b050c5a0a6b546f5529
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jcmd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
        • Size 30.7MB
        • SHA256 dc0edd658f6a05d54cdb061bd7cf03f294132984152aa28db967ae21e47b5018
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jconsole.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
        • Size 30.7MB
        • SHA256 7e46b78172c6b733e897f274e984530d9f8348ab2d70fd107196396ae0af1432
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdb.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
        • Size 29.8MB
        • SHA256 a79fac39d996e97fc692a52445ab9fc5de9f11a15fd38724f5f15d83dcd96465
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdeps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
        • Size 28.9MB
        • SHA256 8505ec95bb1c5433407536e890e0363864fcc8827eaf5a10b64945800afbe127
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jhat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
        • Size 30.7MB
        • SHA256 6cb25fb5a2dbe887be6bf5b9912f8ceefec5805ca56ae02f5f43bfd27f385b12
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jjs.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
        • Size 28.4MB
        • SHA256 81803db47fc8b44d06829d06a84eb85d1788f292a484340976d779bfbadfefe3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jmap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
        • Size 28.8MB
        • SHA256 d1cbc8f08cce0bbdc39086fd5206c6f10153a3035b679be31ba729fc8e83d1bc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jrunscript.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
        • Size 28.8MB
        • SHA256 3d7a0e04b09b1a17790cf59c2d327c327e6afd895c0a2307e7e60cdca5b7cc21
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jsadebugd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
        • Size 28.6MB
        • SHA256 2bbb2a94a1e9b155385ab7e3c5fc376e3b2032b5bb9668af680de9447086b726
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstack.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
        • Size 28.6MB
        • SHA256 814ca17580c1d68122f3a9c211dc25121459699b81d67e614868fa3e3660ad4d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstatd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
        • Size 28.7MB
        • SHA256 09f56f8683aee0f9bde46c2a385cecf7de0fe63f031a587a1cba102b29f97bb4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        keytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
        • Size 28.8MB
        • SHA256 1dcc30bf0c7fa3792ca260604854eafb787f0bb105bd01537e6e89c66145fc74
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        kinit.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
        • Size 27.8MB
        • SHA256 f3f5fe242384d0665f085d312ded4d3e6c689730b50aa65ca0da4376d5472d7c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        klist.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
        • Size 19.4MB
        • SHA256 2f65c4f576ee6ea838e7e3f1a4134df829edc1708ec273eaa268338920bce706
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ktab.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
        • Size 19.3MB
        • SHA256 c065c9346b9d75bd8438fb64798795acfe2e41be1c337ee117f80685caabee4a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        native2ascii.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
        • Size 19.2MB
        • SHA256 1cfcf9e07d1abd6586d2872b901a23dc5bcea220d751786e1f6fe926777914b1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        orbd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
        • Size 19.1MB
        • SHA256 70608ed0f411c9b982b72dccc7904cee1cf6411d72c9ac3026df2bc6fd8ff8df
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        policytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
        • Size 19.0MB
        • SHA256 f422f8d4bee1d1626a582fd5eb55817e2942136f9f07011dc65abd17a1072df0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmic.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
        • Size 18.9MB
        • SHA256 c467e8057bb7a1607e3aaea8ee48325a2450be727f388cc21d5c970dca7ac18f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmid.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
        • Size 18.7MB
        • SHA256 cfd0e52875284214c03512bb86860f923f132643881949a7d1464b10563445ba
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmiregistry.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
        • Size 18.8MB
        • SHA256 17cc71f433a8b62805066f9242fa05e5e011633c0e74cc123f9beffc012aa0f0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dotnet.exe
        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 30.8MB
        • SHA256 6db0be6879e7af8c8162bc52613dd325ebba90c84950f488f75775b6f8c7b399
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 30.7MB
        • SHA256 afa3248fcc33965d0bdb1d6ab568fe2af76ddf939dbc45f801cf8281c59e8726
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 30.7MB
        • SHA256 b39c7aba80f1315fa5ef7f7006ff614aca738513569031c92c15ae0413697231
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 30.7MB
        • SHA256 0e11d581f106b01172aa1648573e9a23b06af12f013d2cc8dd6f8b3b8dc9e369
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        spo0lve.exe
        • Path C:\windows\SysWOW64\drivers\spo0lve.exe
        • Size 15.3MB
        • SHA256 b9d30145d18484772cf27a52528ad69bb9711be5ec64f551fb99a6f1c34b2420
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download