Overview

overview

8

Static

static

3

2026-04-15...ry.exe

windows10-2004-x64

8

2026-04-15...ry.exe

windows11-21h2-x64

8

Analysis

  • max time kernel
    149s
  • max time network
    145s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260130-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    15/04/2026, 23:19

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-04-15_48099e48f1b63df75727efd6a68d2da9_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
  • Size 23.7MB
  • Sample260415-3aybbsd19t
  • SHA256 8a2ff635ad6788cd744cb9ce3e424428571e4ed9d970fc9d868902a645ef21b0
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
defense_evasiondiscoverypersistenceransomware

Malware Config

Signatures

  • Drops file in Drivers directory 3 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Sets desktop wallpaper using registry 2 TTPs 2 IoCs
    ransomware
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies Control Panel 4 IoCs
    defense_evasion
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-04-15_48099e48f1b63df75727efd6a68d2da9_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-04-15_48099e48f1b63df75727efd6a68d2da9_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:4956
  • C:\Users\Admin\AppData\Local\Temp\2026-04-15_48099e48f1b63df75727efd6a68d2da9_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
    C:\Users\Admin\AppData\Local\Temp/2026-04-15_48099e48f1b63df75727efd6a68d2da9_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:384

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        7z.exe
        • Path C:\Program Files\7-Zip\7z.exe
        • Size 48.0MB
        • SHA256 e8eef66ec57529a19affdbf2afb336da7be405bc52f2989f0237da8d07760a63
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        7zFM.exe
        • Path C:\Program Files\7-Zip\7zFM.exe
        • Size 48.4MB
        • SHA256 6a05c20dc13f80fa4ee3365e626e5d5e4b0b30aebdeeaa2bb238a0f366d6a023
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        7zG.exe
        • Path C:\Program Files\7-Zip\7zG.exe
        • Size 48.1MB
        • SHA256 66ad9b2de7258a51334cbc20c2d59676427dce0fc9ce9b7d41c8a44fca8c3f43
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        AppVShNotify.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
        • Size 47.7MB
        • SHA256 c47e18eb341b7a9a6a70099d5b31e7dbeca2278f2479424360801985cb5b6167
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        InspectorOfficeGadget.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
        • Size 47.5MB
        • SHA256 25bfa7b28da5ccc7f7d57e2e1ccdb1c81d7389707a54ed3196601cff32340add
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        IntegratedOffice.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
        • Size 51.5MB
        • SHA256 70cb100aecb6987451f2e267c5635cba89a0973f745de3299b038317db6b6e9e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MavInject32.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
        • Size 47.8MB
        • SHA256 a96640b7029dd95fa90621841686db99b14e8376696811759b82bbbbb456209b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        OfficeC2RClient.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
        • Size 70.9MB
        • SHA256 3ffb295d9cae26f6449400b1ab10af86da557397f4bec318d876eeb6b1e93f6d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appvcleaner.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
        • Size 49.6MB
        • SHA256 ca191ec2606b9fec051f2753296617651594dacf2de7703363471c03cde542a5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VSTOInstaller.exe
        • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
        • Size 47.5MB
        • SHA256 fd632065dfb7a7b36558d6df0aab5f76f04748752cd2f3d09941693550122f3c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ConvertFromSkip.htm
        • Path C:\Program Files\ConvertFromSkip.htm
        • Size 47.8MB
        • SHA256 037e0432e0f55cbeac50c47494cdf850ac5a9cc36250233b0ff6ff2ea902058e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        setup.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
        • Size 53.5MB
        • SHA256 2aa208322138715f8a3799e03944e86a8ac3aed48c061725086256d22019f095
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_pwa_launcher.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 49.2MB
        • SHA256 d518059c3a4a0e4108fb5dfc6e4206c7c840b93b4d8f1c1f9e0d5de2b5b309e1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevated_tracing_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 50.9MB
        • SHA256 305f2c4b4bbb20656c26cf40989f527a8c9c278e7cc212f78c6af0bf8c177c95
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 49.7MB
        • SHA256 02c1a77f0e52c1d10b439e21a999e6c8968755f94bef0e66e91e50c70db77ac5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notification_helper.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 49.1MB
        • SHA256 e43cb05af76e6957d896adb32655c58f2e523e7d8ef37315af576a1420029bd3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        os_update_handler.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 49.3MB
        • SHA256 ba3a7549a31b4aece25f925a48aeca1d983b365d7d36272d544111e8be56e4e5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 50.5MB
        • SHA256 1fbdf614ec4293a738a27ce0bdb475a2299322093ba1a37b2c0fe54fbb22fb96
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_proxy.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 48.9MB
        • SHA256 6c39ec78e34f2d62fac892fdae940fa7ba06af398a751743994a4897a6f0287f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 47.5MB
        • SHA256 f086c5bc73906abff29a50a0463cef6c06564108dc8c89263664fc90a3d1e4f7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 47.5MB
        • SHA256 a2dff7c7fd0a9fd99696aeb7ea45d287c1ee1c77dd5ab2e3609f9911bff2bb57
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jar.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 47.5MB
        • SHA256 a39d3bbb6e2c5854d318b99145ce43da853c8cca861343f64b2868cfa8ead688
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 47.5MB
        • SHA256 bb618150a3243948253c8c3cffbd3c2bd02bce59a4c55c58f1e644e8e2eabcfd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
        • Size 47.7MB
        • SHA256 3d07c780edd15ba3a86c8d21b71e47b1669e80d9eacf3ffbfc53df62e65f12c0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javac.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
        • Size 47.5MB
        • SHA256 42dab9c420e89db9d41cd9630c8f287fb6513095b85ae01012d013d0fcdb34f7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javadoc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
        • Size 47.5MB
        • SHA256 6e5646103602ce4ddfbb092f7120ab3037f541de7f34548f682e3b0f216a6d53
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javah.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
        • Size 47.5MB
        • SHA256 a31a4eab8330f402836a195d3fb63021cd3b65f3421b6178f22c82b2c12e3ff6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
        • Size 47.5MB
        • SHA256 8ce31f378ca69e312bc931978f29a99a0fb1607e232dd8a1316034bb724de100
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javapackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
        • Size 47.6MB
        • SHA256 aa1f80c8ccbfa855e45e14783859527068c9d57da92186e53b15ea8083f23f79
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaw.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
        • Size 47.7MB
        • SHA256 3f71ca8df6762893f890f47b86896a57723c369bd103f077418df557ddbb6a59
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
        • Size 24.2MB
        • SHA256 532de09da539725a7a3ec6a5ccd0ccbb937923a17c8499d4d454247926196e1b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jcmd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
        • Size 47.5MB
        • SHA256 3d0fb8e3828170bc1cebddeb2f3ae6512da2d031a03624d75e892aab9bf98a75
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdb.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
        • Size 47.5MB
        • SHA256 43fbb2476b2ed6f5d0df71a8dd0dbd020b3a657734a29ea76298099a5c21c1ca
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdeps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
        • Size 47.5MB
        • SHA256 96ea90dc6a39344889f0e7c6bdd8f484e59055c422afa1127bf5ae2bb4f5b962
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jinfo.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
        • Size 47.5MB
        • SHA256 54456aa3ebeb11db717d407c82fcc41078cb364a7d070c0bfc1a69c9ca5e7748
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jjs.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
        • Size 47.5MB
        • SHA256 ebb003c9f97c6a133b19db4907b2d3583a0837390fcf278db278bbcdac6bc6b5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jmap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
        • Size 47.5MB
        • SHA256 3851e7a52b15133c453c9a2d58b22e52d300c75e2ff8a12c7ef98beeb7be5d83
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
        • Size 47.5MB
        • SHA256 c32d717b9cb9fe3597e184f3deeac683bdcbbad0bdb420866e114595dc7afcf7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jrunscript.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
        • Size 47.5MB
        • SHA256 c5329d8e1b00d78da612d72d5b271f533a42e008424ccea1a37df9c7ef6c5f66
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jsadebugd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
        • Size 47.5MB
        • SHA256 2b5f18a790881c0b3863978caeacce46f35736e7d8557b951474d4fcd5a2c206
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstack.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
        • Size 47.5MB
        • SHA256 cd2c480515cc2ba4f67442e6a2dfeab21a3f95ea4ed396e316801c93cf2f21eb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
        • Size 47.5MB
        • SHA256 6e7362ba83d55a9e0b6804051cd4d3b7deac696a70a28db48a8343ef11debc54
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstatd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
        • Size 47.5MB
        • SHA256 468a7d4e149ea5b98434019c485822507064dca2c532ae009b02bc74f1ef2f43
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        keytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
        • Size 47.5MB
        • SHA256 db9d4d990bfeaba2ddfce2f15e6e5367ba49122fa8e28ab7f5ab843cc32cbfe1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        kinit.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
        • Size 47.5MB
        • SHA256 38a0227d83193d9ec1af17f048b57ee202b37e96449690896f334ed074251122
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        klist.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
        • Size 47.5MB
        • SHA256 020bf01f701fe88490293617aea7f096292e54940ac9f7d9a9d8651633f2c6bc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ktab.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
        • Size 47.5MB
        • SHA256 3467f80d23ab4b0f2f1a66276fbcffc8625770f569bd24378bd5a8575132ee3d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        native2ascii.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
        • Size 47.5MB
        • SHA256 26eaea98a1c01b02ff47433d95620f9527294dab8629556da61f23e6bb330c23
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        orbd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
        • Size 47.5MB
        • SHA256 ecf5fe9770723f8e032b20dfbee9b9dcd2a7480804c08a3dd701034668a25201
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
        • Size 47.5MB
        • SHA256 af57687ffdaadccd6fffd6488b102f18382a469c9736b32b803032b3aff23525
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dotnet.exe
        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 47.6MB
        • SHA256 99b30c464d35b420938730c3fb7833e229a6fe6276eb833fd44ca21fc65392b3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 47.5MB
        • SHA256 4d86fb0be1537964d2fa8109e91a67804d5ec9ac2d71691dae96899f74649cda
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 47.5MB
        • SHA256 e96c099b0ea0415fae71c4b309c190ec9ae196a447d3518847149e71cd1dd581
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 47.5MB
        • SHA256 104d62dfdb9db775231441ff499b47224abbf41bca89cd6558aad8487c0e850a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        spo0lve.exe
        • Path C:\windows\SysWOW64\drivers\spo0lve.exe
        • Size 23.7MB
        • SHA256 8a2ff635ad6788cd744cb9ce3e424428571e4ed9d970fc9d868902a645ef21b0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/384-257-0x00000000005E0000-0x000000000069F000-memory.dmp
        Download

        memory/384-12-0x00000000005E0000-0x000000000069F000-memory.dmp
        Download

        memory/4956-256-0x0000000000AA0000-0x0000000000B5F000-memory.dmp
        Download

        memory/4956-11-0x0000000000AA0000-0x0000000000B5F000-memory.dmp
        Download