Overview

overview

8

Static

static

3

2026-04-15...jr.exe

windows10-2004-x64

8

2026-04-15...jr.exe

windows11-21h2-x64

8

Analysis

  • max time kernel
    149s
  • max time network
    147s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260130-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    15/04/2026, 15:21

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-04-15_645da22e53023a1140431ba9334f6a0c_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njr.exe
  • Size 10.4MB
  • Sample260415-srkfpabx2j
  • SHA256 b3fc0af28bfe66238691b79b46d7aa8aa553e19889e0bc5714ad97a9fbe6ddba
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
defense_evasiondiscoverypersistenceransomware

Malware Config

Signatures

  • Drops file in Drivers directory 3 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Sets desktop wallpaper using registry 2 TTPs 2 IoCs
    ransomware
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies Control Panel 4 IoCs
    defense_evasion
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-04-15_645da22e53023a1140431ba9334f6a0c_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njr.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-04-15_645da22e53023a1140431ba9334f6a0c_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njr.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:2304
  • C:\Users\Admin\AppData\Local\Temp\2026-04-15_645da22e53023a1140431ba9334f6a0c_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njr.exe
    C:\Users\Admin\AppData\Local\Temp/2026-04-15_645da22e53023a1140431ba9334f6a0c_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njr.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:1400

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        7z.exe
        • Path C:\Program Files\7-Zip\7z.exe
        • Size 21.3MB
        • SHA256 ae3b82fa528565261d81106b0d2b241ba292038242e3be2cb71f8604b8c2a641
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        7zFM.exe
        • Path C:\Program Files\7-Zip\7zFM.exe
        • Size 21.7MB
        • SHA256 2212641851b8457e54e51756d4b2921664f4a3fa41f8741aa9931316ef1caff2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        7zG.exe
        • Path C:\Program Files\7-Zip\7zG.exe
        • Size 21.4MB
        • SHA256 81ab6ba0bd29c1bffdf0ae3ed06831fec451d60157df24e15160f56e671c882f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        7zG.exe
        • Path C:\Program Files\7-Zip\7zG.exe
        • Size 11.1MB
        • SHA256 446fe394420e600ea0f94c760417102d030b19d52dffec19e21ef83869643f33
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Uninstall.exe
        • Path C:\Program Files\7-Zip\Uninstall.exe
        • Size 20.8MB
        • SHA256 95a514d1bd723914cc0e85124120b2af607314cd68aa083aa496dedcceec3871
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        InspectorOfficeGadget.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
        • Size 20.8MB
        • SHA256 f45f3ab8d28bee2b6e32182314880a74c728d3ecb700ba5240221d206a85a448
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        IntegratedOffice.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
        • Size 24.9MB
        • SHA256 4d3d867dd3dbaf1d74732483c4351775e82fdeb10865bc69fced82a9f6814359
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MavInject32.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
        • Size 21.1MB
        • SHA256 4285373a21f3afa9324dc4b8c41ff70e33adf70fc13e39fa910ea3c7ba6d545c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        OfficeC2RClient.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
        • Size 44.2MB
        • SHA256 6276e69a4431349661356dc07d79bf1fe5ed6b7cc008be30e5ca56c3d67292ea
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appvcleaner.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
        • Size 22.9MB
        • SHA256 47af7adc04c42d375ed13359478a927a9eb1b40e5e2bbe9c660eff6521da4dfb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VSTOInstaller.exe
        • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
        • Size 20.9MB
        • SHA256 b32f318d4ab209c320c357d28df5ff1941df52aa8f5cbb8056310ac0aaffe7eb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        setup.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
        • Size 26.8MB
        • SHA256 95384f479f84e124ac9c1979cfcf78081056e99a2dd73c1d4ebb862af5d7fd62
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_pwa_launcher.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 22.5MB
        • SHA256 e8f8bbf5ed82020ab62fe46c20ff8c82b9da458961769e9612fd5ef137f2399e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevated_tracing_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 24.2MB
        • SHA256 fc9431d8568579168a4e5cec4aa19814fd82de3a97793b6ef4134b20b8185867
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 23.0MB
        • SHA256 f6b961bae1cafbb3ded9cd2791851f8b3e45f51cef62bc78f6e01172cfcec81e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notification_helper.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 22.4MB
        • SHA256 9bdcb68e926736483de2dbca82b12169d6f75375ec43b9e8f6a0b62d662a8e8f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 23.8MB
        • SHA256 64adfaebca61de9ef61f2120adc985fc9a2fb45e3b81fd0cb485d19c4c3b225d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 20.8MB
        • SHA256 3ed11fc644ae8d9558ddc2ac7677e2ad914302def76b735684b905404e480fe3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 20.8MB
        • SHA256 2de12ea574fc6e632279d2a470e06282601def4d068bfc7fe1b5e1c5e4a8d234
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 20.8MB
        • SHA256 e6d50e95ba44dd75c8329704dd9c5df106b0ce6eecb90b554fe518b18f4d4ec4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 20.8MB
        • SHA256 673b7521d264436c2291796f6533ad0a6955c4424b98da27d0de76ebf11245dd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jar.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 20.8MB
        • SHA256 e231ea5d36587439de2bc9d767eab32cbf32a3fa1d825bd90b6bd1cea1cd5d1d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jarsigner.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        • Size 20.8MB
        • SHA256 a677e1020383f063d76991b5aa26c6b30c30fdbfccc10b4840ab2bffd691e8e5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 20.8MB
        • SHA256 01842e1dd8efcb0c0286b738a76269dc410e340bccd085f0d1a63572b13853dd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javadoc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
        • Size 20.8MB
        • SHA256 f21f758a181e4685527a9499dcd5c1b69d51c2035bbdd80bc9adab8cf78e4399
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javafxpackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
        • Size 20.9MB
        • SHA256 61ed9d993303788b2d853ca0578a988c61424fec8010a7f106e096bd3411dfb9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javah.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
        • Size 20.8MB
        • SHA256 cfe61034ce3e4664825b1ec0a770c900d43cc717ffe3186c836f674eedac995b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
        • Size 20.8MB
        • SHA256 4a88f3867d914541ef41fdc159fd41a520da02ef14d456c0240913254020d484
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javapackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
        • Size 20.9MB
        • SHA256 69e3f83912355cddcd8b1617fa35e1db5384d9bfc82bfad06766021ef490e8cb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaw.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
        • Size 21.0MB
        • SHA256 93ead7eef255abc0ac0d1c1c4efce4242da0db1b5e1d1ead6c2bee1f8e58c35c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
        • Size 21.2MB
        • SHA256 10cab74fdba80caeb78428a068b7bca262f71534c427c03a72ea370bb735d0b6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jcmd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
        • Size 20.8MB
        • SHA256 a5e14de784ede358e9eb0665bf68db24e8371ff7dcaee01109eb1aa3922f1277
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jconsole.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
        • Size 20.8MB
        • SHA256 d24bce7263d74e5511b00d8ded1e2415b70dd087b4c18ed152474bd188e6dd09
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdb.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
        • Size 20.8MB
        • SHA256 02c7300b27a880721cc68962bd6ebb0ed3529cf26fa14268e3a50b93e8b4626f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdeps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
        • Size 20.8MB
        • SHA256 fdb91a0fcb1e88e4fca6371f47c1989f66112ecb7b0828c54bf42fa95e89ca7c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jhat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
        • Size 20.8MB
        • SHA256 82063c466e295655609548bd2c2b50e060e18facd1c7fda0ac8559609f8b074d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jinfo.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
        • Size 20.8MB
        • SHA256 48dec358f535e9188b1e64ee9592b58dcf3a1ca0976a724f98f64a65e6dab1e8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jjs.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
        • Size 20.8MB
        • SHA256 2b643d08594823ec71eed09226e69f673cdd0f6560d0cef05aa2fcc712dabe83
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jmap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
        • Size 20.8MB
        • SHA256 9f4b54339ecba7e76cb58c12eb24015bd345786ed6e047dd57d286818c675753
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
        • Size 20.8MB
        • SHA256 fa89bde1f7cb37c030a97c7201209a3f362ee5932932cc6654707d131565fb48
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jrunscript.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
        • Size 20.8MB
        • SHA256 c28092b9e8d6d18cb1544d49e4c75faf27892817d7488c39ab1549aa623e9a9b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jsadebugd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
        • Size 20.8MB
        • SHA256 a94db5ed860afd0c704f33fd4d817ec2f50b2bc3b80291a44e73ff754da95c25
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstack.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
        • Size 20.8MB
        • SHA256 fc22511e701455554898a688bb9288ba73792cd01a76b42ae57bc7b2f41e91f0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
        • Size 20.8MB
        • SHA256 2c729fe4e59b264d665f6802e06f548ff5b8f919f033b5bd36c91497f6145c45
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstatd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
        • Size 20.8MB
        • SHA256 ae6c8b46fc257870480ede8352207505e822541da604fb74e969f38235a87078
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        keytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
        • Size 20.8MB
        • SHA256 34b380b09f55a0eec6d1ea0e7ebfc40610a122ecabfb0c53bd3671046186c540
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        kinit.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
        • Size 20.8MB
        • SHA256 60aba1809ba7873af801f6a9a68e845a75febff432e99cf623ffb48d58941809
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        klist.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
        • Size 20.8MB
        • SHA256 0e8bbc6d2b1643ccf5a23f5937a27babcd5aaa1254c3740073345d6f8a7ab5be
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ktab.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
        • Size 20.8MB
        • SHA256 1be26474025bfc6eaba7323cd1a7afd62958a1153efd9b3946e1ade2cfc7fc41
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        native2ascii.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
        • Size 20.8MB
        • SHA256 493f0e730a427c7a1296cca5ff9cd27aece1400eab659d5dc48aecb4ba24056b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        orbd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
        • Size 20.8MB
        • SHA256 882f6b855f98f2b11d54a7b5eb6a386dfe26119552be5cb18e57cfa9c86fa7d9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
        • Size 20.8MB
        • SHA256 f60cd7f924b5c696aa89abbd4cc8e6e6e3ae958737890675a5f7051031a4b4ac
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        policytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
        • Size 20.8MB
        • SHA256 682a8628254567d646a0932588fb0857e4af338362c33ff046363088971953c9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmic.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
        • Size 20.8MB
        • SHA256 4252739420d2bc0fbd9cc822edfed6ad3af58fb06b9a224d9f3009220b189600
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dotnet.exe
        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 20.9MB
        • SHA256 d3749339c83807afc2e3519b4605971cc63cbfb45620a2922d518ffa7de2eafd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 20.8MB
        • SHA256 fa99e5689df8ac54f4f384228672133078bc4d15518944eddba83f179ef01e1e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 20.8MB
        • SHA256 89f30ebbdcfbd557d22061c3eca1c01fb66866dfd8b4c6ca12dce136057dc198
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 20.8MB
        • SHA256 1ffa7fdea76f432151ff019bea16e324a7535a7dec5c5d4415d1ecd1a9542f02
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        spo0lve.exe
        • Path C:\windows\SysWOW64\drivers\spo0lve.exe
        • Size 10.4MB
        • SHA256 b3fc0af28bfe66238691b79b46d7aa8aa553e19889e0bc5714ad97a9fbe6ddba
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/1400-29-0x0000000000A50000-0x0000000001003000-memory.dmp
        Download

        memory/2304-25-0x0000000000AA0000-0x0000000001053000-memory.dmp
        Download