Overview

overview

8

Static

static

3

2026-08-18...ar.exe

windows10-2004-x64

8

2026-08-18...ar.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    148s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    18/08/2026, 18:28

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-18_1dc1c6593bdb27e6501e3f08b2fc3960_amadey_cobalt-strike_elex_emotet_icedid_remcos_vidar.exe
  • Size 6.9MB
  • Sample260818-w4ggcazthy
  • SHA256 364cb815d030036bf08e3153dfbafcfcdaeafde91364d8eb4ed9c85a621df521
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
defense_evasiondiscoverypersistenceransomware

Malware Config

Signatures

  • Drops file in Drivers directory 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Sets desktop wallpaper using registry 2 TTPs 2 IoCs
    ransomware
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies Control Panel 4 IoCs
    defense_evasion
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-18_1dc1c6593bdb27e6501e3f08b2fc3960_amadey_cobalt-strike_elex_emotet_icedid_remcos_vidar.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-18_1dc1c6593bdb27e6501e3f08b2fc3960_amadey_cobalt-strike_elex_emotet_icedid_remcos_vidar.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:3064
  • C:\Users\Admin\AppData\Local\Temp\2026-08-18_1dc1c6593bdb27e6501e3f08b2fc3960_amadey_cobalt-strike_elex_emotet_icedid_remcos_vidar.exe
    C:\Users\Admin\AppData\Local\Temp/2026-08-18_1dc1c6593bdb27e6501e3f08b2fc3960_amadey_cobalt-strike_elex_emotet_icedid_remcos_vidar.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:1844

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        7z.exe
        • Path C:\Program Files\7-Zip\7z.exe
        • Size 7.5MB
        • SHA256 2cc42918e255a6e171cbf24351bde0778dede5270d5f237a0f383f85fed476e2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        7zG.exe
        • Path C:\Program Files\7-Zip\7zG.exe
        • Size 14.6MB
        • SHA256 2078ba1ee91d258af8eea58f7c72e83d6282e44c82961f44954d56141e76a6de
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        AppVShNotify.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
        • Size 14.2MB
        • SHA256 803fdd99c678cb555f872439c5771370cfbdd99d6d429cc22e8525da4dcdd882
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        InspectorOfficeGadget.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
        • Size 13.9MB
        • SHA256 d00763c498b3c414dc22ba629078ac7c2dd34d2f86fe936e2a32417557052fcd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MavInject32.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
        • Size 7.3MB
        • SHA256 5a545d099b7d092c9747bed23da77427188a430b0c193d5e82bf19bc175eae1a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VSTOInstaller.exe
        • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
        • Size 14.0MB
        • SHA256 f71165a547fd983c43ee0b113de0c363bc53148eef5b2e613aba3aafc9d9c52f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        setup.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
        • Size 13.0MB
        • SHA256 73c81cb0a95ff3ac59f96b2cd27181c0c51be5c16976649a3d12c6d8e8d8b42a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_pwa_launcher.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 8.7MB
        • SHA256 c61409d7afc68410f94dd9a572e59092673a59c7ba091084c49ed1fa0fe17361
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevated_tracing_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 17.3MB
        • SHA256 6980cad7a5bc3dd8af243dd70f193fe014fcf81bc09a03ee2dea0a5c9405c8da
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 16.1MB
        • SHA256 eae768065f30ba8535ce116eb80a4881594e864a32e18572d1fefc51bca108fa
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notification_helper.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 8.6MB
        • SHA256 1b834b0a4af08800b4a794f69d48e878087c561378debdb36ea627f1346b28bd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        os_update_handler.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 8.8MB
        • SHA256 1b1760e57ffacd045e15bacc7f2234de5af6c525704ec50730cec9854196f68f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 17.0MB
        • SHA256 2344ee75bbe19c7e493bb3b1d5f179458814510cd4ba6b87ceeba32eb63081a1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_proxy.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 15.3MB
        • SHA256 419a74d6a7aea41e4ffd424fabaf47a6ca1e40b11a479c55dd0e773a0eaf964b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 13.9MB
        • SHA256 d99a253ee8ebe4d27ce899fa1b58bab2778e7efaf85916267f45358c20242062
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 13.9MB
        • SHA256 8e6515d2a40742c3adb0f2fe14409128980597ecfdc81a81acbecf00dd209b40
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 13.9MB
        • SHA256 6e3f691ba2f499cbd10aa5dc9ed1a4b553be7582e568fbc8824219dd8432d211
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jar.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 13.9MB
        • SHA256 fe5127bf6ba23c3d0d3ffbb1bd56582fd71cc6222047a2795ec7109cc802318f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jarsigner.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        • Size 13.9MB
        • SHA256 3d1322bf7c4002b14619575407902bff61820f653e88ad3a97614fef3bea4dc8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 13.9MB
        • SHA256 0ef2f5eb141343b0506574de95fcc521fdc7bed543504b7bea809e69ad06f819
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
        • Size 14.2MB
        • SHA256 d83ae9f550811126e53a4137f83a1a219e6967f2bbaf8408862afd528a048332
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javac.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
        • Size 13.9MB
        • SHA256 11209cf50a39dc7ea6fea62ebe512e49f4845a0d99f9537bd28f5fa236eb45ba
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javafxpackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
        • Size 14.0MB
        • SHA256 dbd1f4b9d59240c9871cdb174fff31a7d9dee63d32a34723a0c198154587957b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javah.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
        • Size 13.9MB
        • SHA256 5de7c6f5b906e10a418669b8d316a51ffaa457b3919e925979a3b943392a0b6a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
        • Size 13.9MB
        • SHA256 7c9652299fb6b15061714dcdc707daf7b71bb70ddea79a62c94b37fd8fb08d4a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javapackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
        • Size 14.0MB
        • SHA256 80dbc05101230d0d93fab42ddf24a90c9a0a6b1f01373148dc8aebf1afcdad9a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaw.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
        • Size 14.2MB
        • SHA256 64cafd6f88f95fed103dcad3bdfd4c86f91ae8c2e9f8cbad7d4fa9990680734f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
        • Size 14.3MB
        • SHA256 faf3e22fa228813982f133b4365b95c748857bea624574d180bca2d018356783
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jcmd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
        • Size 13.9MB
        • SHA256 df41878fe793b92196546fe5a8e54c970b64484d02828627005ad42c93894e73
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jconsole.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
        • Size 13.9MB
        • SHA256 b413674a3df36ec9ea026a8dddc86736ad77616c8ec70097b7e4c968851b4e98
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdb.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
        • Size 13.9MB
        • SHA256 d2f7947296bc7a6c7bef4e17deb5eec1ccec0037b408c5eb4018f7b45a431e74
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdeps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
        • Size 13.9MB
        • SHA256 d4d0b0706ba4fdb128d72a2b8a03d868d5c3ab2bd67dae96daf54cc67c721330
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jhat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
        • Size 13.9MB
        • SHA256 c58f6774f534e51a1bfa9c0de97c972833c8c01dcc41f8d2aa425f9b7bf1fec7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jinfo.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
        • Size 13.9MB
        • SHA256 5901aa2eaa289837bcbefc6a340fb74729e42d51ce2528d6cb079d465d1b0b94
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jjs.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
        • Size 13.9MB
        • SHA256 5550d71ffa13e61c5c7a16d72bfb1d091e342fd0e13f25aaf3d1cb853a57dd93
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jmap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
        • Size 13.9MB
        • SHA256 7ae2bc936753699924c23c63aeeff8811cc8553683361ee37816bf0037d73b95
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
        • Size 13.9MB
        • SHA256 73fb0262593f9596d9b9d52c89e0d5ceb3c44e26668b1e4d446972249d134a15
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jrunscript.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
        • Size 13.9MB
        • SHA256 ff90e3481d9a27c6e197d9d4b8df3dfb20d5c84b74aa5be724a858aeaebe11a9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jsadebugd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
        • Size 13.9MB
        • SHA256 607781d55c4e941b70602825a20ee32ed0f380521d2487dc62f8d69d16a20523
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstack.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
        • Size 13.9MB
        • SHA256 6efddf95fb2c6b8d27478b679f2e7d822aa6b0d2d0888f0476e5d5f72b2662a5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
        • Size 13.9MB
        • SHA256 7b4595423f12f8aacab7a3d11b8056bb64b18ed720f342b7496f283f5d651bfd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstatd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
        • Size 13.9MB
        • SHA256 bf83a9b859cb4aeb65b9df0f50a852cab097145a6c54f67cb5ff2c546d61b5cd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        keytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
        • Size 13.9MB
        • SHA256 dab203c081e674f20fc8f44a256fa1c66a2009be4fe96eec227626fc496c87d8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        kinit.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
        • Size 13.9MB
        • SHA256 b866ad54bae70c218310f167a79277932ae4f7388cbe2b3bf14ba60e93aedb2b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        klist.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
        • Size 13.9MB
        • SHA256 499b88f2fe06b66f0210a99bbdfae3ba2960d865e263e35f9ef585b2c0c26abb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ktab.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
        • Size 13.9MB
        • SHA256 43eda8cb25619e9b0f6b3ffe91e924b9d59a53573336c43283c71a867b65fcbe
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        native2ascii.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
        • Size 13.9MB
        • SHA256 5afd6af53ba382022e44d3c320023b354a73e656fe919aec385a234dfdf6ce72
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        orbd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
        • Size 13.9MB
        • SHA256 c31a54c4709d96ed64cfcb9ea84ed413d5f42e37d83090289bfa3902d4cbaf2a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
        • Size 13.9MB
        • SHA256 85a82cc4b71f459aebc76f0dbf704eec1a7681386cf669f257a480c5b16fd3e8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        policytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
        • Size 13.9MB
        • SHA256 f00645e23a0ebad85d379ede97d3353da2d6f5a654d7555d61f8f47f8e13d77c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmic.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
        • Size 13.9MB
        • SHA256 6fbc4227568a6921f7c6364555cd6da2d32c3048775e318dc4d0e3ef4fdbf408
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmid.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
        • Size 13.9MB
        • SHA256 42b7f9d0e775f3e9a09c4a0462b1b6c02747808a120324f303f542d26cca85ed
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmiregistry.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
        • Size 13.9MB
        • SHA256 5d01684149badd4a446ee5c5d47c361c1cd59fd17bba5f3eddcdab71c6aea512
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        schemagen.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
        • Size 13.9MB
        • SHA256 078bdcbe30b7ebffba688acfc29873fe0619b3955da4a53118efef948d927e5e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        serialver.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
        • Size 13.9MB
        • SHA256 51823bbe1bac415052de172e4e7e14ce6292c26f56c0f44ccb41a63ad06815c5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        servertool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
        • Size 13.9MB
        • SHA256 75c69f8585324ad2d567d2436c92bc50df3ab4d4e24fde8f733dab62b30a3e39
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dotnet.exe
        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 14.0MB
        • SHA256 ca0c7c956f0bc556a80f7797495a8f5027e2c13099b16b4e95730043151dbfcc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 13.9MB
        • SHA256 100a531c56830ba17432a6a0e0a6beee5edb6b55d8be3b6b57895f32b4734b33
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 13.9MB
        • SHA256 cb8fd39de377ec6096854d30001edded6db9c36839312c2ce795b918720ff1c0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download