Overview

overview

8

Static

static

3

2026-08-18...ar.exe

windows10-2004-x64

8

2026-08-18...ar.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    149s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260710-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    18/08/2026, 15:00

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-18_66c67610720a08db3de2f10d4fd439d4_amadey_cobalt-strike_elex_emotet_glassworm_icedid_remcos_vidar.exe
  • Size 15.3MB
  • Sample260818-sdctpavaqe
  • SHA256 b9d30145d18484772cf27a52528ad69bb9711be5ec64f551fb99a6f1c34b2420
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
defense_evasiondiscoverypersistenceransomware

Malware Config

Signatures

  • Drops file in Drivers directory 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Sets desktop wallpaper using registry 2 TTPs 2 IoCs
    ransomware
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies Control Panel 4 IoCs
    defense_evasion
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-18_66c67610720a08db3de2f10d4fd439d4_amadey_cobalt-strike_elex_emotet_glassworm_icedid_remcos_vidar.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-18_66c67610720a08db3de2f10d4fd439d4_amadey_cobalt-strike_elex_emotet_glassworm_icedid_remcos_vidar.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:2456
  • C:\Users\Admin\AppData\Local\Temp\2026-08-18_66c67610720a08db3de2f10d4fd439d4_amadey_cobalt-strike_elex_emotet_glassworm_icedid_remcos_vidar.exe
    C:\Users\Admin\AppData\Local\Temp/2026-08-18_66c67610720a08db3de2f10d4fd439d4_amadey_cobalt-strike_elex_emotet_glassworm_icedid_remcos_vidar.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:5820

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        AppVShNotify.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
        • Size 15.6MB
        • SHA256 8c15409e0f7522b1aec28ad26b3c436c128bff3080f5c7e643be4fe4831ddac6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        InspectorOfficeGadget.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
        • Size 30.7MB
        • SHA256 2b8ece9a7fe0a16ef27b59d4bd17736d0e7ac0c4074074e31660d7f0d44d2b36
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        IntegratedOffice.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
        • Size 34.8MB
        • SHA256 476cac410ceb2d2f30c7400f0d7eaad5383397391a078dc6af8ea0bdab16184e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MavInject32.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
        • Size 31.0MB
        • SHA256 aa0cdd43a7e39a586cb6de2340f5f3343420ee6a709c24a12937729235420640
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        OfficeC2RClient.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
        • Size 54.1MB
        • SHA256 2585018eb72b03a12338281590271ce8133a090d6573e864fe1fb89bec295bc8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appvcleaner.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
        • Size 17.5MB
        • SHA256 43b77a4b6a6c40e714dc2203be9847683138c30598929c652374aeb88ecf0c61
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrmstp.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        • Size 36.7MB
        • SHA256 7bdd91e93ece2721c6013071f08fc78518beb72e60954f3bbfd17eb2657309ab
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevated_tracing_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 18.8MB
        • SHA256 52613426dab2101c74f94827755bf9a48b858216e981fb0ef0ba72566a0de693
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 32.9MB
        • SHA256 5e87fce17f890c5e623cc25ca8d68d25fce6e621e30ff248fd58e14b9bf9bb4f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notification_helper.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 32.3MB
        • SHA256 b1cc59b7531827b786e5b6f770ae71cd4b25ea7ebee5e249ad86a333ec1d4e3d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        os_update_handler.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 32.5MB
        • SHA256 6ecf3b2332aa90b9a193dd9ba4f69ab5ed63c122d803dbdf894310fa2e962ced
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 33.7MB
        • SHA256 6161280d3a21ad880baaf6d6477ecea0671a0ece1edef91679ffb192629019d5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_proxy.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 32.1MB
        • SHA256 eaf07519102d4b187aa127a41f3bc5d75548f7761526d530d958ff0d6851f9ad
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 15.4MB
        • SHA256 8a3e45ae2edbd4e5982894d463ea2bcfeca0535eb051ed151c15db52c7f5d2f9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 30.7MB
        • SHA256 2429238184648e83609f47320b3342e2f2acf7b398db4c7ca42662cbf10a7f24
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 30.7MB
        • SHA256 2e83479242d2f68c3a0d8943397ce642e0c9f78dbbcf9c2733735a28156a6cc0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 30.7MB
        • SHA256 499a9c396b944aa1e663e2faa2a5e8de775deeb7cd8e51b45ec7313f27424a7e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jar.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 30.7MB
        • SHA256 2f77487d53caef5a441a36a694908922ed70e04be1517cdcd72d1a7685f51c6b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jarsigner.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        • Size 30.7MB
        • SHA256 14a27b7695483ae14032e092e8cec5bd97842f588659c7ca1e27d66d1bc95cf9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 30.7MB
        • SHA256 f9d9bcaa7cf6f1ca9a2ffee4407918d390e67738fdba03e5182cd2979d4d55e8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javac.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
        • Size 30.7MB
        • SHA256 9fc5e8f5d566e058f2bde0b634a5444d7770a84826f8697e83c13cfbbbc39d8e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
        • Size 30.7MB
        • SHA256 360759c490cb1bbb9725e9231e68560efb90f9086b609d1dfbfae691a5cce07d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javapackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
        • Size 30.8MB
        • SHA256 8d1ba6f5a071ea23d95b3edf90f78f80ea7242d209aaa0341383fc93adb11f87
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaw.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
        • Size 31.0MB
        • SHA256 4d5d400e9c9039b87d8ef99886f30336a93544e6269124308ede9cefca4efda8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
        • Size 31.1MB
        • SHA256 2ed2fb19150eb6ecd2006c3e40fe114fd7de4ebd61e78b050c5a0a6b546f5529
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jcmd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
        • Size 30.7MB
        • SHA256 dc0edd658f6a05d54cdb061bd7cf03f294132984152aa28db967ae21e47b5018
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jconsole.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
        • Size 30.7MB
        • SHA256 7e46b78172c6b733e897f274e984530d9f8348ab2d70fd107196396ae0af1432
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdb.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
        • Size 30.7MB
        • SHA256 597f88bdc7ce903043d0f235fc38a93060a53d4c064aa892a7643611719ad31d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdeps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
        • Size 30.7MB
        • SHA256 d0cf1f3c030d1c6fc24bf40b7f9b0855121352bf260d250b5f895c1bb727f8d0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jhat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
        • Size 30.7MB
        • SHA256 6cb25fb5a2dbe887be6bf5b9912f8ceefec5805ca56ae02f5f43bfd27f385b12
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jinfo.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
        • Size 30.7MB
        • SHA256 ccd39e3923ff3bd65346049dc79fc9d5424b0368507eefd66f50ec30b4406c99
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jjs.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
        • Size 30.7MB
        • SHA256 cb88b6a1678955d3f6976d2dd52218c099b7279ceb4b1f4f0c5e16656429b182
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jmap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
        • Size 30.7MB
        • SHA256 1dbeeb66998c6d10c423ec0c7575f96b21743b3bea92e449ab2ccb6197db3720
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
        • Size 30.7MB
        • SHA256 ff281eb931bcb7c6352c1c9632927e364bf391e958a2475c32619592295ec33e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jrunscript.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
        • Size 30.7MB
        • SHA256 e315764e19606d3651abc1974c14ab5ac799b36fd449463c2047beffaaefb10f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jsadebugd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
        • Size 30.7MB
        • SHA256 f0c3bfe848422671d7bb4ba3ed5d58f57fd0457e43aac20db8b91dacd8a9212d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstack.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
        • Size 30.7MB
        • SHA256 db90cfe78d1a8c7543195f2a89f39954e8fc58d21f42c33d87e69ac570c2689a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
        • Size 30.7MB
        • SHA256 2ade28e6abc2673ee2813646813006bd9c764ab6be606f46b8a018cf9abe557b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstatd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
        • Size 30.7MB
        • SHA256 9d9e7c957952678c2ba51b173e5395e06a5edf1b78c87e841b7b03d6089b4b2c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        keytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
        • Size 30.7MB
        • SHA256 d620c17bc4cb42cceefeed6029e2b126b30a3e80028d57a178fd44443305f6fa
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        kinit.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
        • Size 30.7MB
        • SHA256 068db80c805e5b40931063aaeb1f6513c54ea4a46ac2ba3e365e1a7cebb6096a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        klist.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
        • Size 30.7MB
        • SHA256 d2451825061b994e5792bca5a5c8d2c4ad24fc53f9bc5e0f8c4ea435aefe148f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ktab.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
        • Size 30.7MB
        • SHA256 35b6d9be7b0e1e4eda73ae2390897959dd93797a897ebadd5e9591ff9fb07761
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        native2ascii.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
        • Size 30.7MB
        • SHA256 0448cd5b93e472dca474038c08606a89ea8fc59912c85538c96a2b4586818fe2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        orbd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
        • Size 30.7MB
        • SHA256 39ab870a773590f4d1124ab5306d1fb155a1b4f285612611c7f1456337922564
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
        • Size 30.7MB
        • SHA256 44f1d6371889a87fbdfbccb4bbd5fb2c209d324d1ad1368eca4e03b645727d1e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        policytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
        • Size 30.7MB
        • SHA256 5c3b5e0eb4860aae2dfe039486997d1d0c2897f7ff88f232f9744ac7c00e9833
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmic.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
        • Size 30.7MB
        • SHA256 031a33630a042352f2071e8b0143cdb5234b934bd601f8fdaf492f0031c88c35
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmid.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
        • Size 30.7MB
        • SHA256 ef116e460f81dfcce02497c5f84009076f7e24463b542cc99068ac4282c391d6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmiregistry.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
        • Size 30.7MB
        • SHA256 946e1f76c73cb150ffe74c00239b5a3db3c1041e7c3dbf9eb5db4a27fc775be9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        schemagen.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
        • Size 30.7MB
        • SHA256 722fb1715b4d8b45c0912a0ae6f153f8374ae1155b436bf37b7a547a9dcd2c67
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        serialver.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
        • Size 30.7MB
        • SHA256 edfd9d0bcbd9130dd49978dd5b7034e9f747bb850835d6a00dc35c8d3c3553c2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        servertool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
        • Size 30.7MB
        • SHA256 e35868dced955c1cd8e2cb0753ab16399fda49b92d9852b9a0951f1b60a538b9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        tnameserv.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
        • Size 30.7MB
        • SHA256 4c30d54817b4ca26e2dcb31151fc578f7781b529247f1ceceec77e59737f2d22
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dotnet.exe
        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 30.8MB
        • SHA256 6db0be6879e7af8c8162bc52613dd325ebba90c84950f488f75775b6f8c7b399
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 30.7MB
        • SHA256 b39c7aba80f1315fa5ef7f7006ff614aca738513569031c92c15ae0413697231
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download