Analysis

  • max time kernel
    149s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260618-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260618-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    28/06/2026, 19:20

General

  • Target
    2026-06-28_c1193448ef775fdb84f76c78c7cd597b_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
  • Size 4.1MB
  • Sample260628-x188mact5x
  • SHA256 ff68dd7b3d91d406a8a59dedcb804ba40ab4fc1c55150dc016ab2160e6b015ac
  • MD5 SHA1 SHA512 SSDEEP TLSH

Malware Config

Signatures

  • Drops file in Drivers directory 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • Sets desktop wallpaper using registry 2 TTPs 2 IoCs
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies Control Panel 4 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-06-28_c1193448ef775fdb84f76c78c7cd597b_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-06-28_c1193448ef775fdb84f76c78c7cd597b_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:6084
  • C:\Users\Admin\AppData\Local\Temp\2026-06-28_c1193448ef775fdb84f76c78c7cd597b_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
    C:\Users\Admin\AppData\Local\Temp/2026-06-28_c1193448ef775fdb84f76c78c7cd597b_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Sets desktop wallpaper using registry
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:2676

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        7zFM.exe

        • Path C:\Program Files\7-Zip\7zFM.exe
        • Size 5.1MB
        • SHA256 53a2adfae657da886d285c5fda6ce0caa9f45028a521710a0688c5a037a881b8
        • MD5 SHA1 SHA512 SSDEEP TLSH

        7zG.exe

        • Path C:\Program Files\7-Zip\7zG.exe
        • Size 4.8MB
        • SHA256 053e9fb39c85bcd90c0cea9dc0b30626afa20c0d64ca53c32213c0c35e59803e
        • MD5 SHA1 SHA512 SSDEEP TLSH

        Uninstall.exe

        • Path C:\Program Files\7-Zip\Uninstall.exe
        • Size 8.2MB
        • SHA256 01c5d2a0632edb6dd6f3b59409ca1c4c74cc08f6d90a109704d4fb7d3247d978
        • MD5 SHA1 SHA512 SSDEEP TLSH

        AppVShNotify.exe

        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
        • Size 4.4MB
        • SHA256 3a4d4796a97068345d1e7b4e19bf913da452d168dc941c622b16d5cea1f6755a
        • MD5 SHA1 SHA512 SSDEEP TLSH

        InspectorOfficeGadget.exe

        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
        • Size 8.3MB
        • SHA256 723ed9402309b2a94e2857e272ed75412c3010ae2136cede55ef0866c1f0e453
        • MD5 SHA1 SHA512 SSDEEP TLSH

        IntegratedOffice.exe

        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
        • Size 12.3MB
        • SHA256 9d7e4c1daa01a92c97cf2c10ad906a7e769a48c2511947a64b62a3e9174a4f69
        • MD5 SHA1 SHA512 SSDEEP TLSH

        MavInject32.exe

        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
        • Size 8.6MB
        • SHA256 7d2b07a064b799b5722adc6b2840627032eb34fdd3cc44f99ae7d32eae53d299
        • MD5 SHA1 SHA512 SSDEEP TLSH

        OfficeC2RClient.exe

        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
        • Size 31.7MB
        • SHA256 299f1ce52b35e90fe17df12464263d1ed78490ecb3b2c3bcdec4e54e3284e8a0
        • MD5 SHA1 SHA512 SSDEEP TLSH

        appvcleaner.exe

        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
        • Size 10.4MB
        • SHA256 1aa5373648b6beaaf2e80a843cc7befdfa7e99cc3abdd6fd68e642dd3c6b50d1
        • MD5 SHA1 SHA512 SSDEEP TLSH

        VSTOInstaller.exe

        • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
        • Size 8.3MB
        • SHA256 10cbf1acf65f7e537ad37744f2900ba2f01d56d80ad2fc7f064e109bb6506eff
        • MD5 SHA1 SHA512 SSDEEP TLSH

        setup.exe

        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
        • Size 14.3MB
        • SHA256 99fb3100158d4d7ee388d8c3885500b5a2533f2b00a1ed946f484bcaa09d40c7
        • MD5 SHA1 SHA512 SSDEEP TLSH

        chrome_pwa_launcher.exe

        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 9.9MB
        • SHA256 de07384a745b83a73405595cae7c80a96019d1fd3d75df859b9e74ea02e1712c
        • MD5 SHA1 SHA512 SSDEEP TLSH

        elevated_tracing_service.exe

        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 11.7MB
        • SHA256 0fb0992a81e9591f92869413c6f7b4f436bf0c9613b8dbe55209e9c8852a8ae8
        • MD5 SHA1 SHA512 SSDEEP TLSH

        elevation_service.exe

        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 10.5MB
        • SHA256 166afffd94297f2b255eefd5d79bc654d02208775e4542c301e48d1274be498d
        • MD5 SHA1 SHA512 SSDEEP TLSH

        notification_helper.exe

        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 9.9MB
        • SHA256 6e250b0d05a733f438c89006255d07868611b9ba12bbc1e5787bbd76ed69dfa9
        • MD5 SHA1 SHA512 SSDEEP TLSH

        os_update_handler.exe

        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 10.1MB
        • SHA256 89f9163e97f3146cf7cc00063728194e870154c42ca0b17dabbfb9288874039d
        • MD5 SHA1 SHA512 SSDEEP TLSH

        chrome.exe

        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 11.3MB
        • SHA256 97841232fb21d58eff7632e52d8762cb1ac5aedd33402f3227b3619fdf81ec53
        • MD5 SHA1 SHA512 SSDEEP TLSH

        chrome_proxy.exe

        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 9.7MB
        • SHA256 24293c8e665b0a24c7e22982fcae2dec0312b24c706cf245c5acdbc04a174705
        • MD5 SHA1 SHA512 SSDEEP TLSH

        appletviewer.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 8.3MB
        • SHA256 7ade03ffe4a28fb6966c58cc303988cd13f31b95f9da6036d4445ce6045b64ea
        • MD5 SHA1 SHA512 SSDEEP TLSH

        extcheck.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 8.3MB
        • SHA256 2a45e48ada70ed3c9b962ea541629009973acf65403de64af64c12d191466c8b
        • MD5 SHA1 SHA512 SSDEEP TLSH

        idlj.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 8.3MB
        • SHA256 63c4a20a1676e1e51c933d50c731446927a28da06d989d291894b3b068a6c8bc
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jabswitch.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 8.3MB
        • SHA256 3b40812093bb243c692b8c1eb223b703ce64a0c89097e18f692ea0ad8d14881a
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jar.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 8.3MB
        • SHA256 58492c8f8c1b97c5da44f8a5f874d1b952a839667d58d279ac7fbfb520a16615
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jarsigner.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        • Size 8.3MB
        • SHA256 bc6328bb52b52dac019381e4451674a48161377c4e9b59d5514557e726395b29
        • MD5 SHA1 SHA512 SSDEEP TLSH

        java-rmi.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 8.3MB
        • SHA256 b005b2c29f3eb8131a383df0bca5211aecd33d61514437d903b0468f466444ee
        • MD5 SHA1 SHA512 SSDEEP TLSH

        java.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
        • Size 8.5MB
        • SHA256 3286082746cce9810e45bdaf80329fdb0c46a20893df51843348256e7ec8b395
        • MD5 SHA1 SHA512 SSDEEP TLSH

        javac.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
        • Size 8.3MB
        • SHA256 3087339c1d8400eb2b50ee1ed63bacfda304e7ab5fd1bcaf168e6e6d1e10a924
        • MD5 SHA1 SHA512 SSDEEP TLSH

        javadoc.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
        • Size 8.3MB
        • SHA256 fd35788a18890b501405d6359699d16a3aec7963cc2813708ee6b84148452e8e
        • MD5 SHA1 SHA512 SSDEEP TLSH

        javafxpackager.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
        • Size 8.4MB
        • SHA256 d2e1ae7c5794404579793d80ce134b3d1a1c77c522d270bf3957df81f4c297c4
        • MD5 SHA1 SHA512 SSDEEP TLSH

        javah.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
        • Size 8.3MB
        • SHA256 e1544febddfba9f372a6e5a755873b6b5ac3acf12e70dc2f166619e2dee05397
        • MD5 SHA1 SHA512 SSDEEP TLSH

        javap.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
        • Size 8.3MB
        • SHA256 75ebf385cdfa3f26cd3fa54103ced476c0f71862916d327b37ced17ea3aa33f6
        • MD5 SHA1 SHA512 SSDEEP TLSH

        javapackager.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
        • Size 8.4MB
        • SHA256 813ac2bb5580f814a47642ba2c176ac882a4aed7864b415168c9c8e46a5fd694
        • MD5 SHA1 SHA512 SSDEEP TLSH

        javaw.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
        • Size 8.5MB
        • SHA256 e0f3c2d5050cf1234e6f5a110265857a22bbffbfd1f503b90b9930fcec292e84
        • MD5 SHA1 SHA512 SSDEEP TLSH

        javaws.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
        • Size 8.7MB
        • SHA256 2c1ecbdc4eff942a4ffdc0da9a57b527fe8313b33e1b365753192a6469bb5110
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jcmd.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
        • Size 8.3MB
        • SHA256 64172d9b25f0677c2d3f7cd3396d215b7b39aa0051bdece28100f1b27d47c5da
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jconsole.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
        • Size 8.3MB
        • SHA256 d586b5f1b61596bdfeb0c797349aa8a9520442c2563850d9e755315ce7195b77
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jdb.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
        • Size 8.3MB
        • SHA256 b2f6c2c44bbe4fdfc1514ddcc0efbb4c7502cc02ac9f07af0de11e12285cc724
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jdeps.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
        • Size 8.3MB
        • SHA256 708c1bbf26e65514b755ec4e3a07575ba7cec90e044e33b47ed3a1110e53b556
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jhat.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
        • Size 8.3MB
        • SHA256 658128d3d87bfcd71931d3cbc6f1fa9eac4c5e7a33b84112d8b0b0e44dbe2d6d
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jinfo.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
        • Size 8.3MB
        • SHA256 9670f40e54ed4237e3147f577ed8fa3f22262283cb2e81cc03bb9e8c284f00e4
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jjs.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
        • Size 8.3MB
        • SHA256 4acdc520664e8ff9ed710c8f944f2906c927b1b771eea7292c1a5d5bb175142a
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jmap.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
        • Size 8.3MB
        • SHA256 d8a8263075b64e34920df2789f910e38f1ac2ee7eea3dbc07b42a21791045f28
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jps.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
        • Size 8.3MB
        • SHA256 b6f95f907d3bee724559cdde0e07489d1c29e7ceaba8f356a6443009081fdd63
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jrunscript.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
        • Size 8.3MB
        • SHA256 910bc381462a9a687e24d2113dbc7b90b7ffe57b2a85f2b716b92522c20377ac
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jsadebugd.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
        • Size 4.1MB
        • SHA256 7dd5ed631f28729a7b7c7949039f28ad00559ec10aa88a6ab070e6cb0136adfd
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jstack.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
        • Size 8.3MB
        • SHA256 4f09174ab58055126f875dee9ad4e6c0f0c0afc5f481ec9f2fb01b00d2a97013
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jstat.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
        • Size 8.3MB
        • SHA256 ac1d3d7015879b43ea079962dbb86e90b64127ced41cf700ede22e15ea38542a
        • MD5 SHA1 SHA512 SSDEEP TLSH

        jstatd.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
        • Size 8.3MB
        • SHA256 ca8fd314d725823d064458b3938f7afc04fc489f64995beeedca8c3363863492
        • MD5 SHA1 SHA512 SSDEEP TLSH

        keytool.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
        • Size 8.3MB
        • SHA256 dd3baaa3f868a0024668904a6760df07358a89371cc6a6b0d3123ee1f8c41c31
        • MD5 SHA1 SHA512 SSDEEP TLSH

        kinit.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
        • Size 8.3MB
        • SHA256 bb98542d1b9ab88ae0ceabd5fd756bbcda8776d84cabb32044845a7d5c6c61a7
        • MD5 SHA1 SHA512 SSDEEP TLSH

        klist.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
        • Size 8.3MB
        • SHA256 815c99353784bfc66ce10e1c6faa9ed804f03d99e2b19fb2254dd3d23ba66941
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ktab.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
        • Size 8.3MB
        • SHA256 2645123b7a0d6cf41036e96d238ccfda1c8d2f2014be9faf5e20072901358119
        • MD5 SHA1 SHA512 SSDEEP TLSH

        native2ascii.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
        • Size 8.3MB
        • SHA256 ebf7b30e43486be10ade0cbeb06a6cfc1e7605c2f108ebd25aa9bcf48ba4bfd8
        • MD5 SHA1 SHA512 SSDEEP TLSH

        orbd.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
        • Size 8.3MB
        • SHA256 6a07ebb809d0d2624d0b9c0f99a0ab41907e843a15e546c8aa1c67e53f48c69c
        • MD5 SHA1 SHA512 SSDEEP TLSH

        pack200.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
        • Size 8.3MB
        • SHA256 3bd4607b99eb7a38d394a8dbfb23ca2b756616b19212cdbf4383c8dbfb044d81
        • MD5 SHA1 SHA512 SSDEEP TLSH

        policytool.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
        • Size 8.3MB
        • SHA256 b58a0addc0ed7cbb86aded6d3953be020ca693c9c6e1eddcaa7449ace3c5b72d
        • MD5 SHA1 SHA512 SSDEEP TLSH

        rmic.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
        • Size 8.3MB
        • SHA256 723f189ae191bf9f1a2e810ca7ebe2b5033e6aee7ab8116f801550179abf07ec
        • MD5 SHA1 SHA512 SSDEEP TLSH

        rmid.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
        • Size 8.3MB
        • SHA256 e73f90729926d7998d17d9492ce38909ea68b7d18eac284faf6a645d432e977b
        • MD5 SHA1 SHA512 SSDEEP TLSH

        rmiregistry.exe

        • Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
        • Size 8.3MB
        • SHA256 61ddfdcbe46cd34645d82b5bdef82c8cba7a039f25c32bf43ce014766402585b
        • MD5 SHA1 SHA512 SSDEEP TLSH

        dotnet.exe

        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 8.4MB
        • SHA256 7c8bb592c7d5d03f7b2e83d3735983c3d915f5d27b5d2ab8b23b8d14dc5d0161
        • MD5 SHA1 SHA512 SSDEEP TLSH

        createdump.exe

        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 8.3MB
        • SHA256 b81bb09c892aae4671717fe0ae082ba5282d58d2195022ad5e0908cfc0b25c60
        • MD5 SHA1 SHA512 SSDEEP TLSH

        createdump.exe

        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 8.3MB
        • SHA256 6b1ba0d42a5d3cbee4df97f78eb7f60452f03f7401cf20cd2c91f221fb308eb9
        • MD5 SHA1 SHA512 SSDEEP TLSH

        createdump.exe

        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 8.3MB
        • SHA256 bc11cd8df9060c6752e0d19fe7359370da825ac5c8504b3adc8d1b3c4002fc39
        • MD5 SHA1 SHA512 SSDEEP TLSH

        memory/2676-110-0x0000000000400000-0x00000000004E4000-memory.dmp

        memory/6084-0-0x0000000000400000-0x00000000004E4000-memory.dmp

        memory/6084-61-0x0000000000400000-0x00000000004E4000-memory.dmp