Overview

overview

8

Static

static

3

2026-04-15...jr.exe

windows10-2004-x64

8

2026-04-15...jr.exe

windows11-21h2-x64

8

Analysis

  • max time kernel
    149s
  • max time network
    96s
  • platform
    windows11-21h2_x64
  • resource
    win11-20260130-en
  • resource tags

    arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
  • submitted
    15/04/2026, 15:21

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-04-15_645da22e53023a1140431ba9334f6a0c_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njr.exe
  • Size 10.4MB
  • Sample260415-srkfpabx2j
  • SHA256 b3fc0af28bfe66238691b79b46d7aa8aa553e19889e0bc5714ad97a9fbe6ddba
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
defense_evasiondiscoverypersistenceransomware

Malware Config

Signatures

  • Drops file in Drivers directory 3 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Sets desktop wallpaper using registry 2 TTPs 2 IoCs
    ransomware
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies Control Panel 4 IoCs
    defense_evasion
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-04-15_645da22e53023a1140431ba9334f6a0c_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njr.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-04-15_645da22e53023a1140431ba9334f6a0c_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njr.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:2136
  • C:\Users\Admin\AppData\Local\Temp\2026-04-15_645da22e53023a1140431ba9334f6a0c_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njr.exe
    C:\Users\Admin\AppData\Local\Temp/2026-04-15_645da22e53023a1140431ba9334f6a0c_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njr.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:5316

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        7zG.exe
        • Path C:\Program Files\7-Zip\7zG.exe
        • Size 11.1MB
        • SHA256 446fe394420e600ea0f94c760417102d030b19d52dffec19e21ef83869643f33
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VSTOInstaller.exe
        • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
        • Size 10.5MB
        • SHA256 d2793031e2820ac3f2694c3da43bbf991d2a5dc4dff1e5dcc755768d4a227496
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrmstp.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        • Size 26.8MB
        • SHA256 a1984258d9e7ee997dc0ff0ab1fde2dcd4452737e1986b6dfc7093835b87e609
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_pwa_launcher.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 22.5MB
        • SHA256 e8f8bbf5ed82020ab62fe46c20ff8c82b9da458961769e9612fd5ef137f2399e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevated_tracing_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 24.2MB
        • SHA256 fc9431d8568579168a4e5cec4aa19814fd82de3a97793b6ef4134b20b8185867
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 23.0MB
        • SHA256 f6b961bae1cafbb3ded9cd2791851f8b3e45f51cef62bc78f6e01172cfcec81e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notification_helper.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 22.4MB
        • SHA256 9bdcb68e926736483de2dbca82b12169d6f75375ec43b9e8f6a0b62d662a8e8f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        os_update_handler.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 22.6MB
        • SHA256 40e52c6a5f283f8cf84e4ba76287fde15c52e9840746a95d0e54b2ea6b727887
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 23.8MB
        • SHA256 64adfaebca61de9ef61f2120adc985fc9a2fb45e3b81fd0cb485d19c4c3b225d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_proxy.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 22.2MB
        • SHA256 1713a46195fa6af8764907fd40bd9299a1edc385bdc247e60aee5c8768b84ce6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 20.8MB
        • SHA256 2de12ea574fc6e632279d2a470e06282601def4d068bfc7fe1b5e1c5e4a8d234
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 20.8MB
        • SHA256 e6d50e95ba44dd75c8329704dd9c5df106b0ce6eecb90b554fe518b18f4d4ec4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 20.8MB
        • SHA256 673b7521d264436c2291796f6533ad0a6955c4424b98da27d0de76ebf11245dd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jar.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 20.8MB
        • SHA256 e231ea5d36587439de2bc9d767eab32cbf32a3fa1d825bd90b6bd1cea1cd5d1d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jarsigner.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        • Size 20.8MB
        • SHA256 a677e1020383f063d76991b5aa26c6b30c30fdbfccc10b4840ab2bffd691e8e5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 20.8MB
        • SHA256 01842e1dd8efcb0c0286b738a76269dc410e340bccd085f0d1a63572b13853dd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
        • Size 21.0MB
        • SHA256 e4319fd6d17ad42bc4da25f1ed02091c78b2c5c2ff5cfd45c76d16b55ed9fb85
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javac.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
        • Size 20.8MB
        • SHA256 0dc6613dc0a8d27414d8a856c9b03fcc2002b2651118026d3092faa822d1b5c8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javadoc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
        • Size 20.8MB
        • SHA256 f21f758a181e4685527a9499dcd5c1b69d51c2035bbdd80bc9adab8cf78e4399
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javafxpackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
        • Size 20.9MB
        • SHA256 61ed9d993303788b2d853ca0578a988c61424fec8010a7f106e096bd3411dfb9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javah.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
        • Size 20.8MB
        • SHA256 cfe61034ce3e4664825b1ec0a770c900d43cc717ffe3186c836f674eedac995b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
        • Size 20.8MB
        • SHA256 4a88f3867d914541ef41fdc159fd41a520da02ef14d456c0240913254020d484
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaw.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
        • Size 10.7MB
        • SHA256 76a3898e85f20bdf34ef6d0085fbe7bfdf7a98373d815404811d1bc01cbb560e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
        • Size 10.8MB
        • SHA256 25589428f4874709e9fc6ca260cf3a91c4bf10b7f553e7c7fab1b2908d7d19a3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jconsole.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
        • Size 10.4MB
        • SHA256 4bdcf350955ef58346df85667d83474653a208c067e4a40d277603543366cb18
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdb.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
        • Size 10.4MB
        • SHA256 949825490b066762595c770fa33670ae4a5c04e0837e833b20947ae895b6dc2c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdeps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
        • Size 20.8MB
        • SHA256 fdb91a0fcb1e88e4fca6371f47c1989f66112ecb7b0828c54bf42fa95e89ca7c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jhat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
        • Size 20.8MB
        • SHA256 82063c466e295655609548bd2c2b50e060e18facd1c7fda0ac8559609f8b074d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jinfo.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
        • Size 20.8MB
        • SHA256 48dec358f535e9188b1e64ee9592b58dcf3a1ca0976a724f98f64a65e6dab1e8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jjs.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
        • Size 20.8MB
        • SHA256 2b643d08594823ec71eed09226e69f673cdd0f6560d0cef05aa2fcc712dabe83
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jmap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
        • Size 20.8MB
        • SHA256 9f4b54339ecba7e76cb58c12eb24015bd345786ed6e047dd57d286818c675753
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
        • Size 20.8MB
        • SHA256 fa89bde1f7cb37c030a97c7201209a3f362ee5932932cc6654707d131565fb48
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jsadebugd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
        • Size 20.8MB
        • SHA256 a94db5ed860afd0c704f33fd4d817ec2f50b2bc3b80291a44e73ff754da95c25
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstack.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
        • Size 20.8MB
        • SHA256 fc22511e701455554898a688bb9288ba73792cd01a76b42ae57bc7b2f41e91f0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstat.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
        • Size 20.8MB
        • SHA256 2c729fe4e59b264d665f6802e06f548ff5b8f919f033b5bd36c91497f6145c45
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jstatd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
        • Size 20.8MB
        • SHA256 ae6c8b46fc257870480ede8352207505e822541da604fb74e969f38235a87078
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        keytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
        • Size 20.8MB
        • SHA256 34b380b09f55a0eec6d1ea0e7ebfc40610a122ecabfb0c53bd3671046186c540
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        kinit.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
        • Size 20.8MB
        • SHA256 60aba1809ba7873af801f6a9a68e845a75febff432e99cf623ffb48d58941809
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        klist.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
        • Size 20.8MB
        • SHA256 0e8bbc6d2b1643ccf5a23f5937a27babcd5aaa1254c3740073345d6f8a7ab5be
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ktab.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
        • Size 20.8MB
        • SHA256 1be26474025bfc6eaba7323cd1a7afd62958a1153efd9b3946e1ade2cfc7fc41
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        native2ascii.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
        • Size 20.8MB
        • SHA256 493f0e730a427c7a1296cca5ff9cd27aece1400eab659d5dc48aecb4ba24056b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        orbd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
        • Size 20.8MB
        • SHA256 882f6b855f98f2b11d54a7b5eb6a386dfe26119552be5cb18e57cfa9c86fa7d9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
        • Size 10.4MB
        • SHA256 4d3057a7c9cb7517bb42564f889ad45925a21bd3d27299ec139ea816db58a5ee
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        policytool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
        • Size 20.8MB
        • SHA256 682a8628254567d646a0932588fb0857e4af338362c33ff046363088971953c9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmic.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
        • Size 20.8MB
        • SHA256 4252739420d2bc0fbd9cc822edfed6ad3af58fb06b9a224d9f3009220b189600
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmid.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
        • Size 20.8MB
        • SHA256 d6ba7296b04bcd6e945124cc364cb1c9d706d046203b85e890e08e63f31230c7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        rmiregistry.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
        • Size 20.8MB
        • SHA256 a2025403a1bde4de1181786b1957ca6380597e4b869db9bbe00c23722a1522ba
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        schemagen.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
        • Size 20.8MB
        • SHA256 6051b6d53d2f271b22657d87bc705c45e72aaf62e42ccd842996be26b37ac944
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        serialver.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
        • Size 20.8MB
        • SHA256 9b9c571d484ddfe230a6b6f189cab4f3b55e4a0b5c304fc1c652f5fe22dd42f4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        servertool.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
        • Size 20.8MB
        • SHA256 4de6d2aebdf75b1ca4b6d46cea8ffbb72281693e2f2e6aa7112aafcea0d38c3a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        tnameserv.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
        • Size 20.8MB
        • SHA256 19a54f0f1a74b3cd35cc07967f3eefe38eab7c70ee64666a54d70f53e5e54463
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        unpack200.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\unpack200.exe
        • Size 21.0MB
        • SHA256 ddb24daefe727fa9f4b92dd3bbf30cc8dd8b371516dd5dd3fa2b6b12527f8639
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        wsgen.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
        • Size 20.8MB
        • SHA256 9a357e961ccdc212f612e3596d9274b03a9b683731069fc51032c2385ae891da
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        wsimport.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
        • Size 20.8MB
        • SHA256 08016fc47cd4de70f65ced38826a37297600ae787ef31b768d29c6df99be7ae8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        xjc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
        • Size 20.8MB
        • SHA256 47c055a420b8e0bd86d7c1ff091071216dc92d43a2c4a0d2961bbe8eb2da2ef9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dotnet.exe
        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 20.9MB
        • SHA256 d3749339c83807afc2e3519b4605971cc63cbfb45620a2922d518ffa7de2eafd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 20.8MB
        • SHA256 fa99e5689df8ac54f4f384228672133078bc4d15518944eddba83f179ef01e1e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 20.8MB
        • SHA256 89f30ebbdcfbd557d22061c3eca1c01fb66866dfd8b4c6ca12dce136057dc198
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 20.8MB
        • SHA256 1ffa7fdea76f432151ff019bea16e324a7535a7dec5c5d4415d1ecd1a9542f02
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        spo0lve.exe
        • Path C:\windows\SysWOW64\drivers\spo0lve.exe
        • Size 10.4MB
        • SHA256 b3fc0af28bfe66238691b79b46d7aa8aa553e19889e0bc5714ad97a9fbe6ddba
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/2136-98-0x0000000002470000-0x000000000254A000-memory.dmp
        Download

        memory/5316-100-0x0000000002320000-0x00000000023FA000-memory.dmp
        Download