Overview

overview

8

Static

static

3

2026-06-26...ry.exe

windows10-2004-x64

8

2026-06-26...ry.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    147s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260513-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    29/06/2026, 12:31

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-06-26_c4236b730a351bdb2a6d98bed7250afc_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
  • Size 37.9MB
  • Sample260629-pp3mpsdv2t
  • SHA256 1f61843573070f357d72650e9e06d22111793616fe3c2cb470ee57cc115443bd
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
discoverypersistence

Malware Config

Signatures

  • Drops file in Drivers directory 3 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Drops file in Program Files directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-06-26_c4236b730a351bdb2a6d98bed7250afc_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-06-26_c4236b730a351bdb2a6d98bed7250afc_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe"
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:2864
  • C:\Users\Admin\AppData\Local\Temp\2026-06-26_c4236b730a351bdb2a6d98bed7250afc_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
    C:\Users\Admin\AppData\Local\Temp/2026-06-26_c4236b730a351bdb2a6d98bed7250afc_amadey_cobalt-strike_elex_emotet_hijackloader_icedid_njrat_remcos_vidar_wannacry.exe
    1⤵
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:3824

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        7z.exe
        • Path C:\Program Files\7-Zip\7z.exe
        • Size 76.3MB
        • SHA256 a1628f69fd41f6b2bbf3e9edff0f9a5c33be9675b4be7c7d385dbbb74878e86d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        7zFM.exe
        • Path C:\Program Files\7-Zip\7zFM.exe
        • Size 76.7MB
        • SHA256 b51a946110936d2f4d05ded508abade286c9bc641b2a819b6636829666589849
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        7zG.exe
        • Path C:\Program Files\7-Zip\7zG.exe
        • Size 76.4MB
        • SHA256 05a2ca791017a90d9e38b810e5b3a3a6a5a5e5f11c044b126382166db987a5aa
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Uninstall.exe
        • Path C:\Program Files\7-Zip\Uninstall.exe
        • Size 75.8MB
        • SHA256 375948f23b4fcdab023c5192b0dbabbe0ec6d7f47c8a61d145fe4a0380cc7a70
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        AssertResize.asp
        • Path C:\Program Files\AssertResize.asp
        • Size 76.9MB
        • SHA256 fe111f35e26edc509482cadd2f912dcc49cc0dc69616c0210eb9abc7fd1fd1fe
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        AppVShNotify.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
        • Size 76.0MB
        • SHA256 7c5aa206ce31cde332dd199959aefdf3ed042fd4786a6539dea361bc365d6e0a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        InspectorOfficeGadget.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
        • Size 75.8MB
        • SHA256 041d6bc92db93ccefad82174a07a4959a9ade5280afcb2f174b957655c778854
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        IntegratedOffice.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
        • Size 79.9MB
        • SHA256 d3981a5164aa18a87dda5ac515a9cc865b998ff2a28951916af71f5cfec347f6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MavInject32.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
        • Size 76.1MB
        • SHA256 8dbbabebb45c6ff2154ac2c82069ac1391432e60d84e6bf5f5d744249ce51fb0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appvcleaner.exe
        • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
        • Size 77.9MB
        • SHA256 ab58777c7439bd4993630360749a67f455f095181519f4f067c62e11bcaaa8d2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VSTOInstaller.exe
        • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
        • Size 75.9MB
        • SHA256 59241321fb32ce43685f2c4f3ef491bdb00d8795402ebfc0f24631747c0288aa
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrmstp.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        • Size 81.8MB
        • SHA256 2c79b074eecc0e4b9850dd2dcd5e489c2362befa38db715e3d652aca79ad549f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_pwa_launcher.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
        • Size 77.5MB
        • SHA256 96590e5e3330d65db6b1a4b721b0ee11d204323ef3a3238d44f0a6ae302ec8be
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevated_tracing_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
        • Size 79.2MB
        • SHA256 f160dd4cc1efbb69f35228635bcdeceddc6b00b3da039bc790327e17353653d8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 78.0MB
        • SHA256 458308986c1dcaac94f4e87e7defab6ee73b63f85312b49a3d2c7aeefb598ae7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        notification_helper.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
        • Size 77.4MB
        • SHA256 5f41cfbb324dafc435fc1a6cd4bd833316095b9fd0938068128e05f8f5a81729
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        os_update_handler.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
        • Size 77.6MB
        • SHA256 d882a74b2898470652e1506e13adc7d4743629c45a02ddae364d91c011f0eef3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome.exe
        • Size 78.8MB
        • SHA256 7cd811e8fa3a9bd4da197ffa0206952cef646500511d2214346f987c80505a27
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        chrome_proxy.exe
        • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
        • Size 77.2MB
        • SHA256 4c2aeb515ee02b10b2500a4fc61abafae1769ab4e6bdb720c144f6ff26c33178
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        appletviewer.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
        • Size 75.8MB
        • SHA256 ee6adfd3b052349a690994b3611539595627171abba4fece173c455c736c599a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        extcheck.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
        • Size 75.8MB
        • SHA256 33e3fa2c5161e182ad0de0fe7c6a69d9c993b476c9858ad6c541a5fdfde89a1a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        idlj.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
        • Size 75.8MB
        • SHA256 b65cc6adb28e82b14a01457a678c435786133ac0754798d7819cedd1998c89b7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jabswitch.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
        • Size 75.8MB
        • SHA256 53f317163e2fcfd064e4102661e05db74d854a84a57ae705a59f0feb2d329680
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jar.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
        • Size 75.8MB
        • SHA256 709d2b0af59668bf417cc6d8da0cacfca04deb971c4b02ecf9f23421ca7951dc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jarsigner.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
        • Size 75.8MB
        • SHA256 335a4f7e42b4959709651668c8d65a769c66e25e935d92d8e62ecd1ea551f42d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java-rmi.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
        • Size 75.8MB
        • SHA256 5b5cd0ec56d01fddd1791ab1f517012c20dc9950d560e2dcaa248cc68e8539b1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        java.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
        • Size 76.0MB
        • SHA256 c813d33d03bb2d455e614198a87f1b822ed447e5d04d6135a87be08f487c77fe
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javac.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
        • Size 75.8MB
        • SHA256 fcb9cb6310a6296c7d544d5588575570873251871568d433590beaf47c38aa6e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javadoc.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
        • Size 75.8MB
        • SHA256 c84138dc5ff602567562f3c14198622fd8d304815070ef4618f4775d17582a39
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javafxpackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
        • Size 75.9MB
        • SHA256 de707cbac6239a4578e4e3e1af48bddbe22f3eeef82b80bcb928c70fea806fe5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javah.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
        • Size 75.8MB
        • SHA256 51564a36ba74a19df07437f94b1d289a2a5a8ebd8fe02d164144128336eaeedf
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javap.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
        • Size 75.8MB
        • SHA256 5966f36f21369fc3e6c5c17d75927e8c1db136458615f0975e0dde16f0a7d6f5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javapackager.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
        • Size 75.9MB
        • SHA256 bbfe5b37747e3d5e07942f4c156207b40c42cb11f8fbf174672d6103bf70e69d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaw.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
        • Size 76.0MB
        • SHA256 3dd33a7e3e35fab3d3d1a1d77291913b3e785b3e1fd02c90c11849d7a9851318
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        javaws.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
        • Size 38.3MB
        • SHA256 54416f64384902e01f619f7f180d3950fd7a5b966db953c2aaf59b86986f2b6c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jcmd.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
        • Size 70.4MB
        • SHA256 20f1dd497faec6d6360cd99186bcad1325f18cda0076e1e8427fb32bbf51db00
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jconsole.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
        • Size 63.1MB
        • SHA256 5c1f28833fae6b0d63d746cdcd38ebdd77c4a7b7621226b5b845332bbb6671b4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdb.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
        • Size 31.1MB
        • SHA256 22238a0a81941a9bca659ca72a8bb853ee7408686d76b24deac047f79fd8ba40
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        jdeps.exe
        • Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
        • Size 8.3MB
        • SHA256 083220199d16e5a073b2d307041d6e698ba356d394b6d019558c983f0168b8e4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        dotnet.exe
        • Path C:\Program Files\dotnet\dotnet.exe
        • Size 75.9MB
        • SHA256 1fa03e804e145368172971dcb84107354670d0376602c85699624724eb9a68a8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
        • Size 75.8MB
        • SHA256 96507101ca09159ae89f9ac3ca5b884bc87a2080f4e650edadb6fcfca7d6e511
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
        • Size 75.8MB
        • SHA256 851c75b0a30751491b35bdaa937e42e3c21b2ecb0f7a3254c462eac7dc10e2ab
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        createdump.exe
        • Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
        • Size 75.8MB
        • SHA256 f84343af10d9e5a8799db46a758212bc71969bde93940296d86689d5fc1e0792
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        spo0lve.exe
        • Path C:\windows\SysWOW64\drivers\spo0lve.exe
        • Size 37.9MB
        • SHA256 1f61843573070f357d72650e9e06d22111793616fe3c2cb470ee57cc115443bd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/2864-0-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download

        memory/2864-5-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download

        memory/3824-13-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download

        memory/3824-2-0x0000000000400000-0x00000000004E4000-memory.dmp
        Download