Overview

overview

7

Static

static

3

2026-08-28...ar.exe

windows10-2004-x64

7

2026-08-28...ar.exe

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    91s
  • max time network
    114s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    28/08/2026, 06:30

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-28_edce85d34b2fcee7cd8ff134e40a299f_amadey_cobalt-strike_elex_emotet_glassworm_smoke-loader_stop_vidar.exe
  • Size 3.6MB
  • Sample260828-g9pmkstthy
  • SHA256 786e01a19f1113dc343036b1aa52c166aa8869730c0f2e6786c59caa848a8d44
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
discoveryexecutionpersistenceprivilege_escalation

Malware Config

Signatures

  • Event Triggered Execution: Component Object Model Hijacking 1 TTPs

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation
  • Executes dropped EXE 11 IoCs
  • Adds Run key to start application 2 TTPs 24 IoCs
    persistence
  • Executes a VBScript file via the Windows Script Host. 1 TTPs 15 IoCs
    execution
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 9 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 35 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies registry class 64 IoCs
  • NTFS ADS 12 IoCs
  • Suspicious use of SetWindowsHookEx 12 IoCs
  • Suspicious use of WriteProcessMemory 33 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-28_edce85d34b2fcee7cd8ff134e40a299f_amadey_cobalt-strike_elex_emotet_glassworm_smoke-loader_stop_vidar.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-28_edce85d34b2fcee7cd8ff134e40a299f_amadey_cobalt-strike_elex_emotet_glassworm_smoke-loader_stop_vidar.exe"
    1⤵
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • NTFS ADS
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1856
    • C:\Windows\SysWOW64\regsvr32.exe
      regsvr32.exe /s scrrun.dll
      2⤵
      • System Location Discovery: System Language Discovery
      • Modifies registry class
      PID:2164
    • C:\Windows\SysWOW64\wscript.exe
      wscript.exe "C:\documents and settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\2C10A89\399852.vbs"
      2⤵
      • Executes a VBScript file via the Windows Script Host.
      • System Location Discovery: System Language Discovery
      PID:5056
    • C:\Users\Admin\AppData\Local\Temp\628.#.exe
      C:\Users\Admin\AppData\Local\Temp\628.#.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Drops file in Program Files directory
      • System Location Discovery: System Language Discovery
      • NTFS ADS
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:3672
      • C:\Windows\SysWOW64\regsvr32.exe
        regsvr32.exe /s scrrun.dll
        3⤵
        • System Location Discovery: System Language Discovery
        • Modifies registry class
        PID:5796
      • C:\Windows\SysWOW64\wscript.exe
        wscript.exe "C:\documents and settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\2C10A89\140896.vbs"
        3⤵
        • Executes a VBScript file via the Windows Script Host.
        • System Location Discovery: System Language Discovery
        PID:472
      • C:\Users\Admin\AppData\Local\Temp\316.#.exe
        C:\Users\Admin\AppData\Local\Temp\316.#.exe
        3⤵
        • Executes dropped EXE
        • Adds Run key to start application
        • System Location Discovery: System Language Discovery
        • NTFS ADS
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:1300
        • C:\Windows\SysWOW64\regsvr32.exe
          regsvr32.exe /s scrrun.dll
          4⤵
          • System Location Discovery: System Language Discovery
          • Modifies registry class
          PID:5380
        • C:\Windows\SysWOW64\wscript.exe
          wscript.exe "C:\documents and settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\2C10A89\136684.vbs"
          4⤵
          • Executes a VBScript file via the Windows Script Host.
          • System Location Discovery: System Language Discovery
          PID:1792
        • C:\Users\Admin\AppData\Local\Temp\444.#.exe
          C:\Users\Admin\AppData\Local\Temp\444.#.exe
          4⤵
            PID:3472
            • C:\Windows\SysWOW64\regsvr32.exe
              regsvr32.exe /s scrrun.dll
              5⤵
                PID:1832
              • C:\Windows\SysWOW64\wscript.exe
                wscript.exe "C:\documents and settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\2C10A89\188793.vbs"
                5⤵
                • Executes a VBScript file via the Windows Script Host.
                PID:4632
      • C:\Windows\system32\regsvr32.exe
        regsvr32.exe /s scrrun.dll
        1⤵
        • Modifies registry class
        PID:3728
      • C:\10a0699fa37928d39c\spfirewall.exe
        C:\10a0699fa37928d39c\spfirewall.exe
        1⤵
        • Executes dropped EXE
        • Adds Run key to start application
        • Drops file in Program Files directory
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • NTFS ADS
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:1968
        • C:\Windows\SysWOW64\regsvr32.exe
          regsvr32.exe /s scrrun.dll
          2⤵
          • System Location Discovery: System Language Discovery
          • Modifies registry class
          PID:1028
        • C:\Windows\SysWOW64\wscript.exe
          wscript.exe "C:\documents and settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\2C10A89\511577.vbs"
          2⤵
          • Executes a VBScript file via the Windows Script Host.
          • System Location Discovery: System Language Discovery
          PID:952
        • C:\10a0699fa37928d39c\772.#.exe
          C:\10a0699fa37928d39c\772.#.exe
          2⤵
          • Executes dropped EXE
          • Adds Run key to start application
          • Drops file in Program Files directory
          • Drops file in Windows directory
          • System Location Discovery: System Language Discovery
          • NTFS ADS
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:2172
          • C:\Windows\SysWOW64\regsvr32.exe
            regsvr32.exe /s scrrun.dll
            3⤵
            • System Location Discovery: System Language Discovery
            • Modifies registry class
            PID:3716
          • C:\Windows\SysWOW64\wscript.exe
            wscript.exe "C:\documents and settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\2C10A89\569194.vbs"
            3⤵
            • Executes a VBScript file via the Windows Script Host.
            • System Location Discovery: System Language Discovery
            PID:5824
          • C:\10a0699fa37928d39c\368.#.exe
            C:\10a0699fa37928d39c\368.#.exe
            3⤵
            • Executes dropped EXE
            • Adds Run key to start application
            • Drops file in Program Files directory
            • Drops file in Windows directory
            • System Location Discovery: System Language Discovery
            • NTFS ADS
            • Suspicious use of SetWindowsHookEx
            • Suspicious use of WriteProcessMemory
            PID:3232
            • C:\Windows\SysWOW64\regsvr32.exe
              regsvr32.exe /s scrrun.dll
              4⤵
              • System Location Discovery: System Language Discovery
              • Modifies registry class
              PID:5008
            • C:\Windows\SysWOW64\wscript.exe
              wscript.exe "C:\documents and settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\2C10A89\327617.vbs"
              4⤵
              • Executes a VBScript file via the Windows Script Host.
              • System Location Discovery: System Language Discovery
              PID:3460
            • C:\10a0699fa37928d39c\648.#.exe
              C:\10a0699fa37928d39c\648.#.exe
              4⤵
              • Executes dropped EXE
              • Adds Run key to start application
              • Drops file in Program Files directory
              • Drops file in Windows directory
              • System Location Discovery: System Language Discovery
              • NTFS ADS
              • Suspicious use of SetWindowsHookEx
              • Suspicious use of WriteProcessMemory
              PID:5956
              • C:\Windows\SysWOW64\regsvr32.exe
                regsvr32.exe /s scrrun.dll
                5⤵
                • System Location Discovery: System Language Discovery
                • Modifies registry class
                PID:912
              • C:\Windows\SysWOW64\wscript.exe
                wscript.exe "C:\documents and settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\2C10A89\290645.vbs"
                5⤵
                • Executes a VBScript file via the Windows Script Host.
                • System Location Discovery: System Language Discovery
                PID:3300
              • C:\10a0699fa37928d39c\184.#.exe
                C:\10a0699fa37928d39c\184.#.exe
                5⤵
                • Executes dropped EXE
                • Adds Run key to start application
                • Drops file in Program Files directory
                • Drops file in Windows directory
                • System Location Discovery: System Language Discovery
                • NTFS ADS
                • Suspicious use of SetWindowsHookEx
                • Suspicious use of WriteProcessMemory
                PID:864
                • C:\Windows\SysWOW64\regsvr32.exe
                  regsvr32.exe /s scrrun.dll
                  6⤵
                  • System Location Discovery: System Language Discovery
                  • Modifies registry class
                  PID:4700
                • C:\Windows\SysWOW64\wscript.exe
                  wscript.exe "C:\documents and settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\2C10A89\559047.vbs"
                  6⤵
                  • Executes a VBScript file via the Windows Script Host.
                  • System Location Discovery: System Language Discovery
                  PID:2808
                • C:\10a0699fa37928d39c\730.#.exe
                  C:\10a0699fa37928d39c\730.#.exe
                  6⤵
                  • Executes dropped EXE
                  • Adds Run key to start application
                  • Drops file in Program Files directory
                  • Drops file in Windows directory
                  • System Location Discovery: System Language Discovery
                  • NTFS ADS
                  • Suspicious use of SetWindowsHookEx
                  • Suspicious use of WriteProcessMemory
                  PID:4452
                  • C:\Windows\SysWOW64\regsvr32.exe
                    regsvr32.exe /s scrrun.dll
                    7⤵
                    • System Location Discovery: System Language Discovery
                    • Modifies registry class
                    PID:5056
                  • C:\Windows\SysWOW64\wscript.exe
                    wscript.exe "C:\documents and settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\2C10A89\899273.vbs"
                    7⤵
                    • Executes a VBScript file via the Windows Script Host.
                    • System Location Discovery: System Language Discovery
                    PID:2040
                  • C:\10a0699fa37928d39c\639.#.exe
                    C:\10a0699fa37928d39c\639.#.exe
                    7⤵
                    • Executes dropped EXE
                    • Adds Run key to start application
                    • Drops file in Program Files directory
                    • Drops file in Windows directory
                    • System Location Discovery: System Language Discovery
                    • NTFS ADS
                    • Suspicious use of SetWindowsHookEx
                    • Suspicious use of WriteProcessMemory
                    PID:3764
                    • C:\Windows\SysWOW64\regsvr32.exe
                      regsvr32.exe /s scrrun.dll
                      8⤵
                      • System Location Discovery: System Language Discovery
                      • Modifies registry class
                      PID:5168
                    • C:\Windows\SysWOW64\wscript.exe
                      wscript.exe "C:\documents and settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\2C10A89\270931.vbs"
                      8⤵
                      • Executes a VBScript file via the Windows Script Host.
                      • System Location Discovery: System Language Discovery
                      PID:5960
                    • C:\10a0699fa37928d39c\312.#.exe
                      C:\10a0699fa37928d39c\312.#.exe
                      8⤵
                      • Executes dropped EXE
                      • Adds Run key to start application
                      • Drops file in Windows directory
                      • System Location Discovery: System Language Discovery
                      • NTFS ADS
                      • Suspicious use of SetWindowsHookEx
                      • Suspicious use of WriteProcessMemory
                      PID:4652
                      • C:\Windows\SysWOW64\regsvr32.exe
                        regsvr32.exe /s scrrun.dll
                        9⤵
                        • System Location Discovery: System Language Discovery
                        • Modifies registry class
                        PID:5332
                      • C:\Windows\SysWOW64\wscript.exe
                        wscript.exe "C:\documents and settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\2C10A89\9212.vbs"
                        9⤵
                        • Executes a VBScript file via the Windows Script Host.
                        • System Location Discovery: System Language Discovery
                        PID:4104
                      • C:\10a0699fa37928d39c\252.#.exe
                        C:\10a0699fa37928d39c\252.#.exe
                        9⤵
                        • Executes dropped EXE
                        • Adds Run key to start application
                        • Drops file in Windows directory
                        • System Location Discovery: System Language Discovery
                        • NTFS ADS
                        • Suspicious use of SetWindowsHookEx
                        • Suspicious use of WriteProcessMemory
                        PID:5136
                        • C:\Windows\SysWOW64\regsvr32.exe
                          regsvr32.exe /s scrrun.dll
                          10⤵
                          • System Location Discovery: System Language Discovery
                          • Modifies registry class
                          PID:4284
                        • C:\Windows\SysWOW64\wscript.exe
                          wscript.exe "C:\documents and settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\2C10A89\30651.vbs"
                          10⤵
                          • Executes a VBScript file via the Windows Script Host.
                          PID:4316
                        • C:\10a0699fa37928d39c\748.#.exe
                          C:\10a0699fa37928d39c\748.#.exe
                          10⤵
                            PID:5728
                            • C:\Windows\SysWOW64\regsvr32.exe
                              regsvr32.exe /s scrrun.dll
                              11⤵
                                PID:4884
                              • C:\Windows\SysWOW64\wscript.exe
                                wscript.exe "C:\documents and settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\2C10A89\908931.vbs"
                                11⤵
                                • Executes a VBScript file via the Windows Script Host.
                                PID:2756
                              • C:\10a0699fa37928d39c\482.#.exe
                                C:\10a0699fa37928d39c\482.#.exe
                                11⤵
                                  PID:2664
                                  • C:\Windows\SysWOW64\regsvr32.exe
                                    regsvr32.exe /s scrrun.dll
                                    12⤵
                                      PID:3460
                                    • C:\Windows\SysWOW64\wscript.exe
                                      wscript.exe "C:\documents and settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\2C10A89\317257.vbs"
                                      12⤵
                                      • Executes a VBScript file via the Windows Script Host.
                                      PID:3324
                                    • C:\10a0699fa37928d39c\635.#.exe
                                      C:\10a0699fa37928d39c\635.#.exe
                                      12⤵
                                        PID:4172
                                        • C:\Windows\SysWOW64\regsvr32.exe
                                          regsvr32.exe /s scrrun.dll
                                          13⤵
                                            PID:5260

                  Network

                        MITRE ATT&CK Enterprise v16

                        Replay Monitor

                        Loading Replay Monitor...

                        Downloads

                        spfirewall.exe
                        • Path C:\10a0699fa37928d39c\spfirewall.exe
                        • Size 3.6MB
                        • SHA256 786e01a19f1113dc343036b1aa52c166aa8869730c0f2e6786c59caa848a8d44
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        rmid.exe$
                        • Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe$
                        • Size 3.6MB
                        • SHA256 1f6617b1d1b7d42d2dad5f9c9df3fe4029169dbf357dd72d7d43eee254704ad0
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        AppVDllSurrogate32.exe$
                        • Path C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate32.exe$
                        • Size 3.7MB
                        • SHA256 e1e9272cb1a4ce646061f1eaf95b9198edf148c32e360dd8ce9a3693b82dcfd1
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        EXCEL.EXE
                        • Path C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE
                        • Size 3.8MB
                        • SHA256 670cbfcd9cb54b8f6c8d5bd7e2d15962aeb0f75fc856c37b707dd4964575bbcf
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        GRAPH.EXE$
                        • Path C:\Program Files\Microsoft Office\root\Office16\GRAPH.EXE$
                        • Size 3.8MB
                        • SHA256 749eba88bf6394570a39b775f6877a4e4a460d98136097022725058d3c6907c9
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        399852.vbs
                        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\2C10A89\399852.vbs
                        • Size 19KB
                        • SHA256 68af315a2e48e340c71d9235a050dac6f82ac1c10fcc4b7158aeb32230530a9a
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        511577.vbs
                        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\2C10A89\511577.vbs
                        • Size 3KB
                        • SHA256 2a3778aaf48a20cb25dbb3f22fee19c7b1ae104e697bc4ffbfe5e524e9b087e5
                        • MD5 SHA1 SHA512 TLSH
                        Submit Download

                        memory/1856-0-0x0000000000400000-0x000000000040E000-memory.dmp
                        Download