Overview

overview

8

Static

static

3

2026-04-15...ry.exe

windows10-2004-x64

8

2026-04-15...ry.exe

windows11-21h2-x64

8

Analysis

  • max time kernel
    149s
  • max time network
    94s
  • platform
    windows11-21h2_x64
  • resource
    win11-20260130-en
  • resource tags

    arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
  • submitted
    15/04/2026, 23:19

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-04-15_48099e48f1b63df75727efd6a68d2da9_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
  • Size 23.7MB
  • Sample260415-3aybbsd19t
  • SHA256 8a2ff635ad6788cd744cb9ce3e424428571e4ed9d970fc9d868902a645ef21b0
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
defense_evasiondiscoverypersistenceransomware

Malware Config

Signatures

  • Drops file in Drivers directory 3 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Sets desktop wallpaper using registry 2 TTPs 2 IoCs
    ransomware
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies Control Panel 4 IoCs
    defense_evasion
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-04-15_48099e48f1b63df75727efd6a68d2da9_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-04-15_48099e48f1b63df75727efd6a68d2da9_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:996
  • C:\Users\Admin\AppData\Local\Temp\2026-04-15_48099e48f1b63df75727efd6a68d2da9_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
    C:\Users\Admin\AppData\Local\Temp/2026-04-15_48099e48f1b63df75727efd6a68d2da9_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:5420

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        7z.exe
        • Path C:\Program Files\7-Zip\7z.exe
        • Size 24.3MB
        • SHA256 f296d301699ae374a02d407d366167e23346698cfc82621f0e8ce20430036bba
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        7zFM.exe
        • Path C:\Program Files\7-Zip\7zFM.exe
        • Size 24.7MB
        • SHA256 eddcb80b0d24915575bbde55112bafbcbaf6c202a51a1cff821e4ae53ee434ca
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        7zG.exe
        • Path C:\Program Files\7-Zip\7zG.exe
        • Size 24.4MB
        • SHA256 f372035fa47f312f54c4d637def23134338cba6c11fdb0194860ae2c337cbd19
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Uninstall.exe
        • Path C:\Program Files\7-Zip\Uninstall.exe
        • Size 47.5MB
        • SHA256 c6a791633aab664aa05c3c376c9904f08d081d118b619b9e9fd7926a1deeb5c5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        AppVShNotify.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
        • Size 47.7MB
        • SHA256 c47e18eb341b7a9a6a70099d5b31e7dbeca2278f2479424360801985cb5b6167
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        InspectorOfficeGadget.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
        • Size 47.5MB
        • SHA256 25bfa7b28da5ccc7f7d57e2e1ccdb1c81d7389707a54ed3196601cff32340add
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        IntegratedOffice.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
        • Size 51.5MB
        • SHA256 70cb100aecb6987451f2e267c5635cba89a0973f745de3299b038317db6b6e9e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MavInject32.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
        • Size 47.8MB
        • SHA256 a96640b7029dd95fa90621841686db99b14e8376696811759b82bbbbb456209b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        OfficeC2RClient.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
        • Size 70.9MB
        • SHA256 3ffb295d9cae26f6449400b1ab10af86da557397f4bec318d876eeb6b1e93f6d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appvcleaner.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
        • Size 49.6MB
        • SHA256 ca191ec2606b9fec051f2753296617651594dacf2de7703363471c03cde542a5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrmstp.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        • Size 53.5MB
        • SHA256 2aa208322138715f8a3799e03944e86a8ac3aed48c061725086256d22019f095
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_pwa_launcher.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 49.2MB
        • SHA256 d518059c3a4a0e4108fb5dfc6e4206c7c840b93b4d8f1c1f9e0d5de2b5b309e1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notification_helper.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 49.1MB
        • SHA256 e43cb05af76e6957d896adb32655c58f2e523e7d8ef37315af576a1420029bd3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        os_update_handler.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 49.3MB
        • SHA256 ba3a7549a31b4aece25f925a48aeca1d983b365d7d36272d544111e8be56e4e5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 50.5MB
        • SHA256 1fbdf614ec4293a738a27ce0bdb475a2299322093ba1a37b2c0fe54fbb22fb96
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_proxy.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 48.9MB
        • SHA256 6c39ec78e34f2d62fac892fdae940fa7ba06af398a751743994a4897a6f0287f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 47.5MB
        • SHA256 5f1d2431c621ac74348cf6a5b39dd4dbc566f3ee51472467f95ff32e474d9c57
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 47.5MB
        • SHA256 f3d60188edd6b8992fb240cb2d3280478dfcaff7dbcd6ae1332173e31261ece5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jar.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 47.5MB
        • SHA256 a39d3bbb6e2c5854d318b99145ce43da853c8cca861343f64b2868cfa8ead688
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jarsigner.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        • Size 47.5MB
        • SHA256 83e0526c24a31356859a42f6524d14965e1cb9d866a1a2de8f3799049c3b6b9d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 47.5MB
        • SHA256 bb618150a3243948253c8c3cffbd3c2bd02bce59a4c55c58f1e644e8e2eabcfd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
        • Size 47.7MB
        • SHA256 3d07c780edd15ba3a86c8d21b71e47b1669e80d9eacf3ffbfc53df62e65f12c0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javadoc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
        • Size 47.5MB
        • SHA256 6e5646103602ce4ddfbb092f7120ab3037f541de7f34548f682e3b0f216a6d53
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javafxpackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
        • Size 47.6MB
        • SHA256 92242261ed5776a2138e16388e5ac51d172b9624f9685540e30e5bfdaaa33e39
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javah.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
        • Size 47.5MB
        • SHA256 a31a4eab8330f402836a195d3fb63021cd3b65f3421b6178f22c82b2c12e3ff6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
        • Size 47.5MB
        • SHA256 8ce31f378ca69e312bc931978f29a99a0fb1607e232dd8a1316034bb724de100
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javapackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
        • Size 47.6MB
        • SHA256 aa1f80c8ccbfa855e45e14783859527068c9d57da92186e53b15ea8083f23f79
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaw.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
        • Size 47.7MB
        • SHA256 3f71ca8df6762893f890f47b86896a57723c369bd103f077418df557ddbb6a59
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
        • Size 47.9MB
        • SHA256 717b618eb1493a7ea28ffea9da8600f0ddb78c318d5b460a514f034bf45ea242
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jconsole.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
        • Size 47.5MB
        • SHA256 157412b5778395c6b0112ea2f0d2281cdfcad86e74a05cfd1d4f1408747e983d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdb.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
        • Size 47.5MB
        • SHA256 43fbb2476b2ed6f5d0df71a8dd0dbd020b3a657734a29ea76298099a5c21c1ca
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdeps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
        • Size 47.5MB
        • SHA256 96ea90dc6a39344889f0e7c6bdd8f484e59055c422afa1127bf5ae2bb4f5b962
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jhat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
        • Size 47.5MB
        • SHA256 4fd79f039400af0d81f06cbe0d1581ea0435824fdb0f745b563e497583b338b5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jinfo.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
        • Size 47.5MB
        • SHA256 54456aa3ebeb11db717d407c82fcc41078cb364a7d070c0bfc1a69c9ca5e7748
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jjs.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
        • Size 47.5MB
        • SHA256 ebb003c9f97c6a133b19db4907b2d3583a0837390fcf278db278bbcdac6bc6b5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jmap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
        • Size 47.5MB
        • SHA256 3851e7a52b15133c453c9a2d58b22e52d300c75e2ff8a12c7ef98beeb7be5d83
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
        • Size 47.5MB
        • SHA256 c32d717b9cb9fe3597e184f3deeac683bdcbbad0bdb420866e114595dc7afcf7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jrunscript.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
        • Size 47.5MB
        • SHA256 c5329d8e1b00d78da612d72d5b271f533a42e008424ccea1a37df9c7ef6c5f66
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jsadebugd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
        • Size 47.5MB
        • SHA256 2b5f18a790881c0b3863978caeacce46f35736e7d8557b951474d4fcd5a2c206
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstack.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
        • Size 47.5MB
        • SHA256 cd2c480515cc2ba4f67442e6a2dfeab21a3f95ea4ed396e316801c93cf2f21eb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
        • Size 47.5MB
        • SHA256 6e7362ba83d55a9e0b6804051cd4d3b7deac696a70a28db48a8343ef11debc54
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstatd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
        • Size 47.5MB
        • SHA256 468a7d4e149ea5b98434019c485822507064dca2c532ae009b02bc74f1ef2f43
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        keytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
        • Size 47.5MB
        • SHA256 db9d4d990bfeaba2ddfce2f15e6e5367ba49122fa8e28ab7f5ab843cc32cbfe1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        kinit.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
        • Size 47.5MB
        • SHA256 38a0227d83193d9ec1af17f048b57ee202b37e96449690896f334ed074251122
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        klist.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
        • Size 47.5MB
        • SHA256 020bf01f701fe88490293617aea7f096292e54940ac9f7d9a9d8651633f2c6bc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ktab.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
        • Size 47.5MB
        • SHA256 3467f80d23ab4b0f2f1a66276fbcffc8625770f569bd24378bd5a8575132ee3d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        native2ascii.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
        • Size 47.5MB
        • SHA256 26eaea98a1c01b02ff47433d95620f9527294dab8629556da61f23e6bb330c23
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        orbd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
        • Size 47.5MB
        • SHA256 ecf5fe9770723f8e032b20dfbee9b9dcd2a7480804c08a3dd701034668a25201
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
        • Size 47.5MB
        • SHA256 af57687ffdaadccd6fffd6488b102f18382a469c9736b32b803032b3aff23525
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        policytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
        • Size 47.5MB
        • SHA256 459f2b5441b7ad68303ed65ef39f411733d557c4fed57bafb7550658b624ab79
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmic.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
        • Size 47.5MB
        • SHA256 bbf709bbc228c91abffa6b6bf5613633267d9489f3d5eb93d2154575afc04a83
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dotnet.exe
        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 47.6MB
        • SHA256 99b30c464d35b420938730c3fb7833e229a6fe6276eb833fd44ca21fc65392b3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 47.5MB
        • SHA256 4d86fb0be1537964d2fa8109e91a67804d5ec9ac2d71691dae96899f74649cda
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 47.5MB
        • SHA256 e96c099b0ea0415fae71c4b309c190ec9ae196a447d3518847149e71cd1dd581
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 47.5MB
        • SHA256 104d62dfdb9db775231441ff499b47224abbf41bca89cd6558aad8487c0e850a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        spo0lve.exe
        • Path C:\windows\SysWOW64\drivers\spo0lve.exe
        • Size 23.7MB
        • SHA256 8a2ff635ad6788cd744cb9ce3e424428571e4ed9d970fc9d868902a645ef21b0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/996-72-0x0000000000B70000-0x0000000000C31000-memory.dmp
        Download

        memory/5420-89-0x0000000000910000-0x00000000009D1000-memory.dmp
        Download